ifconfig is dead, long-live iproute2 this also uses only awk to do the grepping and removal of CIDR notation Show Sample Output

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -

I much prefer using /sbin/ip over /sbin/ifconfig for most everything. I find the interface and output to be much more consistent and it has many abilities that ifconfig, route, etc. do not. To get the mac address for only one interface, add 'show dev [interface]' to the 'ip link' part of the command: ip link show dev eth0 | grep 'link/ether' | awk '{print $2}' . Also, both this command and the ifconfig one do not require root access to run, so the sudo is not necessary. Show Sample Output