Commands tagged wireshark sorted by votes

Commands tagged wireshark (13)

sorted by

analyze traffic remotely over ssh w/ wireshark

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -
This is sample output - yours may be different.
31

ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -

markdrago · 2009-12-17 23:03:24 54
analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering.
This is sample output - yours may be different.
13

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

abb · 2010-10-28 09:02:39 7
analyze traffic remotely over ssh w/ wireshark

Please check out my blog article on this for more detail. http://jdubb.net/blog/2009/08/07/monitor-wireshark-capture-real-time-on-remote-host-via-ssh/
This is sample output - yours may be different.
3

mkfifo /tmp/fifo; ssh-keygen; ssh-copyid root@remotehostaddress; sudo ssh root@remotehost "tshark -i eth1 -f 'not tcp port 22' -w -" > /tmp/fifo &; sudo wireshark -k -i /tmp/fifo;

Code_Bleu · 2010-01-05 14:40:06 4
analyze traffic remotely over ssh w/ wireshark

commandline for mac os x
This is sample output - yours may be different.
3

ssh user@server.com sudo tcpdump -i eth0 -w - 'port 80'| /Applications/Wireshark.app/Contents/Resources/bin/wireshark -k -i -

bkendinibilir · 2012-01-23 18:16:22 4
Sniff ONLY POP3 authentication by intercepting the USER command

dsniff is general purpose password sniffer, it handles *lots* of different protocols, but it also handles tcp-style expressions for limiting analyzed traffic - so I can limit it to work on pop3 only. Show Sample Output
This is sample output - yours may be different.
```
dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2
```
2

dsniff -i any 'tcp port pop3'

depesz · 2010-11-18 09:43:40 3

trace http requests on the specified interface. uses the amazing tshark tool (http://www.wireshark.org/docs/man-pages/tshark.html) Show Sample Output

tshark -i en1 -z proto,colinfo,http.request.uri,http.request.uri -R http.request.uri

lele · 2011-04-05 14:18:35 4

Sniff ONLY POP3 authentication by intercepting the USER command

The command is useful for monitoring the use of the boxes and their connection IP. Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command: tcpdump -f "sniff" -XX Show Sample Output
This is sample output - yours may be different.
```
USER username@maildomain.com
```
0

tcpdump -i eth0 "tcp port pop3 and ip[40] = 85 and ip[41] = 83" -s 1500 -n -w "sniff"

ironmarc · 2010-11-18 09:03:08 3
analyze traffic remotely over ssh w/ wireshark

analyze traffic remotely over ssh w/ wireshark When using tcpdump, specify -U option to prevent buffering and -iany to see all interfaces. Show Sample Output
This is sample output - yours may be different.
```
wireshark launches
```
0

ssh root@HOST tcpdump -iany -U -s0 -w - 'not port 22' | wireshark -k -i -

dr3s · 2011-09-13 21:10:40 5
analyze traffic remotely over ssh w/ wireshark

Replace servername with your user. And make sure you have generated / copied your rsa_pub key to the remote server, or you will be asked for a password which will stuff up the output to wireshark.
This is sample output - yours may be different.
0

wireshark -k -i <(ssh -l root servername "dumpcap -P -w - -f 'not tcp port 22'")

lmitchell · 2015-08-10 05:22:36 8
tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap

capture trafic for wireshark from spesific eth interface Show Sample Output
This is sample output - yours may be different.
```
tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap
```
0

tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap

erez83 · 2015-10-21 09:14:26 10
tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap

tcpdump into file with date format for wireshark Show Sample Output
This is sample output - yours may be different.
```
tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap
```
0

tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap

erez83 · 2015-10-21 09:54:13 8
analyze traffic remotely over ssh w/ wireshark

Commandline for windows + cygwin with specific interface and resolved ip.
This is sample output - yours may be different.
0

ssh root@server.com "tcpdump -i INTERFACE_NAME -U -nnn -s0 -w - 'port 80'" | /cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -N mnNtCd -k -i -

artembeloglazov · 2016-03-02 13:42:29 12
analyze traffic remotely over ssh w/ wireshark

This allows you to display the wireshark program running on remote pc to your local pc.
This is sample output - yours may be different.
-8

sudo ssh -Y remoteuser@remotehost sudo wireshark

Code_Bleu · 2010-01-05 14:35:20 4

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Which processes are listening on a specific port (e.g. port 80)

swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

list block devices

Shows all block devices in a tree with descruptions of what they are.

Watch active calls on an Asterisk PBX

Only the number of calls nothing else.

FInd the 10 biggest files taking up disk space

Often you need to find the files that are taking up the most disk space in order to free up space asap. This script can be run on the enitre filesystem as root or on a home directory to find the largest files.

Find files and calculate size of result in shell

Find files and calculate size with stat of result in shell

floating point operations in shell scripts

using bc is for sissies. dc is much better :-D Polish notation will rule the world...

Search some text from all files inside a directory

Find passwords that has been stored as plain text in NetworkManager

Which processes are listening on a specific port (e.g. port 80)

swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Startup a VPN connection through command line

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)
» commands tagged wireshark

Commands tagged wireshark (13) the last day the last week the last month all time sorted by date votes

What's this?

Check These Out

Stay in the loop…

Commands tagged wireshark (13)

sorted by