Commands tagged wireshark sorted by votes

Commands tagged wireshark (13)

sorted by

analyze traffic remotely over ssh w/ wireshark

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -
This is sample output - yours may be different.
32

ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -

markdrago · 2009-12-17 23:03:24 54
analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering.
This is sample output - yours may be different.
13

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

abb · 2010-10-28 09:02:39 7
analyze traffic remotely over ssh w/ wireshark

Please check out my blog article on this for more detail. http://jdubb.net/blog/2009/08/07/monitor-wireshark-capture-real-time-on-remote-host-via-ssh/
This is sample output - yours may be different.
3

mkfifo /tmp/fifo; ssh-keygen; ssh-copyid root@remotehostaddress; sudo ssh root@remotehost "tshark -i eth1 -f 'not tcp port 22' -w -" > /tmp/fifo &; sudo wireshark -k -i /tmp/fifo;

Code_Bleu · 2010-01-05 14:40:06 4
analyze traffic remotely over ssh w/ wireshark

commandline for mac os x
This is sample output - yours may be different.
3

ssh user@server.com sudo tcpdump -i eth0 -w - 'port 80'| /Applications/Wireshark.app/Contents/Resources/bin/wireshark -k -i -

bkendinibilir · 2012-01-23 18:16:22 4
Sniff ONLY POP3 authentication by intercepting the USER command

dsniff is general purpose password sniffer, it handles *lots* of different protocols, but it also handles tcp-style expressions for limiting analyzed traffic - so I can limit it to work on pop3 only. Show Sample Output
This is sample output - yours may be different.
```
dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2
```
2

dsniff -i any 'tcp port pop3'

depesz · 2010-11-18 09:43:40 3

trace http requests on the specified interface. uses the amazing tshark tool (http://www.wireshark.org/docs/man-pages/tshark.html) Show Sample Output

tshark -i en1 -z proto,colinfo,http.request.uri,http.request.uri -R http.request.uri

lele · 2011-04-05 14:18:35 4

Sniff ONLY POP3 authentication by intercepting the USER command

The command is useful for monitoring the use of the boxes and their connection IP. Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command: tcpdump -f "sniff" -XX Show Sample Output
This is sample output - yours may be different.
```
USER username@maildomain.com
```
0

tcpdump -i eth0 "tcp port pop3 and ip[40] = 85 and ip[41] = 83" -s 1500 -n -w "sniff"

ironmarc · 2010-11-18 09:03:08 3
analyze traffic remotely over ssh w/ wireshark

analyze traffic remotely over ssh w/ wireshark When using tcpdump, specify -U option to prevent buffering and -iany to see all interfaces. Show Sample Output
This is sample output - yours may be different.
```
wireshark launches
```
0

ssh root@HOST tcpdump -iany -U -s0 -w - 'not port 22' | wireshark -k -i -

dr3s · 2011-09-13 21:10:40 5
analyze traffic remotely over ssh w/ wireshark

Replace servername with your user. And make sure you have generated / copied your rsa_pub key to the remote server, or you will be asked for a password which will stuff up the output to wireshark.
This is sample output - yours may be different.
0

wireshark -k -i <(ssh -l root servername "dumpcap -P -w - -f 'not tcp port 22'")

lmitchell · 2015-08-10 05:22:36 8
tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap

capture trafic for wireshark from spesific eth interface Show Sample Output
This is sample output - yours may be different.
```
tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap
```
0

tcpdump -i eth1 -s0 -v -w /tmp/capture.pcap

erez83 · 2015-10-21 09:14:26 10
tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap

tcpdump into file with date format for wireshark Show Sample Output
This is sample output - yours may be different.
```
tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap
```
0

tcpdump -i eth1 -s0 -v -w /tmp/capture_`date +%d_%m_%Y__%H_%I_%S`.pcap

erez83 · 2015-10-21 09:54:13 8
analyze traffic remotely over ssh w/ wireshark

Commandline for windows + cygwin with specific interface and resolved ip.
This is sample output - yours may be different.
0

ssh root@server.com "tcpdump -i INTERFACE_NAME -U -nnn -s0 -w - 'port 80'" | /cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -N mnNtCd -k -i -

artembeloglazov · 2016-03-02 13:42:29 12
analyze traffic remotely over ssh w/ wireshark

This allows you to display the wireshark program running on remote pc to your local pc.
This is sample output - yours may be different.
-8

sudo ssh -Y remoteuser@remotehost sudo wireshark

Code_Bleu · 2010-01-05 14:35:20 4

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

View an info page on a nice interface

Nice interface for an info page.

Which processes are listening on a specific port (e.g. port 80)

swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Check a server is up. If it isn't mail me.

Joker wants an email if the Brand X server is down. Set a cron job for every 5 mins with this line and he gets an email when/if a ping takes longer than 3 seconds.

Last Minute Cheap Essay

Writing a paper is never an easy chore. When students start college, they are confronted with a variety of new situations, but one of the most difficult is completing projects before the deadline. Many students' physical and mental health can suffer as a result of pressure, stress, and anxiety. International students face significant difficulties because English is a difficult language for them. After lessons and long college hours, many students don’t have the time or energy to write extensive essays. Students can be seen juggling classes, jobs, social lives, and finding time for themselves. I need someone to write an essay for me, you might be thinking. Prepare to be surprised! With our assignment service, we can help you get rid of all of your troubles. We will write an A+ essay for you to ensure that you get good grades on your tasks.

Detect illegal access to kernel space, potentially useful for Meltdown detection

Based on capsule8 agent examples, not rigorously tested

Show numerical values for each of the 256 colors in bash

I like the other three versions but one uses nested loops and another prints every color on a separate line. Both versions fail to reset colors before giving the prompt back. This version uses the column command to print a table so all the colors fit on one screen. It also resets colors back to normal before as a last step.

list with full path

background a wget download

Determining the excat memory usages by certain PID

this command gives you the total number of memory usuage and open files by the perticuler PID.

openssl Generate Self Signed SSL Certifcate

generating self signed ssl certificate to use in dovecot postfix nginx Self signed certificates can be used for private encryptions between server and client and must be manually accepted on browser/ client

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)
» commands tagged wireshark

Commands tagged wireshark (13) the last day the last week the last month all time sorted by date votes

What's this?

Check These Out

Stay in the loop…

Commands tagged wireshark (13)

sorted by