Commands tagged sniff sorted by votes

Commands tagged sniff (11)

sorted by

analyze traffic remotely over ssh w/ wireshark

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -
This is sample output - yours may be different.
31

ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -

markdrago · 2009-12-17 23:03:24 38
sniff network traffic on a given interface and displays the IP addresses of the machines communicating with the current host (one IP per line)
This is sample output - yours may be different.
21

sudo tcpdump -i wlan0 -n ip | awk '{ print gensub(/(.*)\..*/,"\\1","g",$3), $4, gensub(/(.*)\..*/,"\\1","g",$5) }' | awk -F " > " '{print $1"\n"$2}'

tweet78 · 2014-04-11 22:41:32 9
analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering.
This is sample output - yours may be different.
13

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

abb · 2010-10-28 09:02:39 6
analyze traffic remotely over ssh w/ wireshark

Please check out my blog article on this for more detail. http://jdubb.net/blog/2009/08/07/monitor-wireshark-capture-real-time-on-remote-host-via-ssh/
This is sample output - yours may be different.
3

mkfifo /tmp/fifo; ssh-keygen; ssh-copyid root@remotehostaddress; sudo ssh root@remotehost "tshark -i eth1 -f 'not tcp port 22' -w -" > /tmp/fifo &; sudo wireshark -k -i /tmp/fifo;

Code_Bleu · 2010-01-05 14:40:06 3
analyze traffic remotely over ssh w/ wireshark

commandline for mac os x
This is sample output - yours may be different.
3

ssh user@server.com sudo tcpdump -i eth0 -w - 'port 80'| /Applications/Wireshark.app/Contents/Resources/bin/wireshark -k -i -

bkendinibilir · 2012-01-23 18:16:22 3
Sniff ONLY POP3 authentication by intercepting the USER command

dsniff is general purpose password sniffer, it handles *lots* of different protocols, but it also handles tcp-style expressions for limiting analyzed traffic - so I can limit it to work on pop3 only. Show Sample Output
This is sample output - yours may be different.
```
dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2
```
2

dsniff -i any 'tcp port pop3'

depesz · 2010-11-18 09:43:40 2
Sniff ONLY POP3 authentication by intercepting the USER command

The command is useful for monitoring the use of the boxes and their connection IP. Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command: tcpdump -f "sniff" -XX Show Sample Output
This is sample output - yours may be different.
```
USER username@maildomain.com
```
0

tcpdump -i eth0 "tcp port pop3 and ip[40] = 85 and ip[41] = 83" -s 1500 -n -w "sniff"

ironmarc · 2010-11-18 09:03:08 2
analyze traffic remotely over ssh w/ wireshark

analyze traffic remotely over ssh w/ wireshark When using tcpdump, specify -U option to prevent buffering and -iany to see all interfaces. Show Sample Output
This is sample output - yours may be different.
```
wireshark launches
```
0

ssh root@HOST tcpdump -iany -U -s0 -w - 'not port 22' | wireshark -k -i -

dr3s · 2011-09-13 21:10:40 3
analyze traffic remotely over ssh w/ wireshark

Replace servername with your user. And make sure you have generated / copied your rsa_pub key to the remote server, or you will be asked for a password which will stuff up the output to wireshark.
This is sample output - yours may be different.
0

wireshark -k -i <(ssh -l root servername "dumpcap -P -w - -f 'not tcp port 22'")

lmitchell · 2015-08-10 05:22:36 8
analyze traffic remotely over ssh w/ wireshark

Commandline for windows + cygwin with specific interface and resolved ip.
This is sample output - yours may be different.
0

ssh root@server.com "tcpdump -i INTERFACE_NAME -U -nnn -s0 -w - 'port 80'" | /cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -N mnNtCd -k -i -

artembeloglazov · 2016-03-02 13:42:29 12
analyze traffic remotely over ssh w/ wireshark

This allows you to display the wireshark program running on remote pc to your local pc.
This is sample output - yours may be different.
-8

sudo ssh -Y remoteuser@remotehost sudo wireshark

Code_Bleu · 2010-01-05 14:35:20 3

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Display the definition of a shell function

Display the code of a previously defined shell function.

Use bash history with process substitution

Bash has a great history system of its commands accessed by the ! built-in history expansion operator (documented elsewhere on this site or on the web). You can combine the ! operator inside the process redirection

List all files/folders in working directory with their total size in Megabytes

backup system over ssh, exlucde common dirs

Spell check the text in clipboard (paste the corrected clipboard if you like)

xclip -o > /tmp/spell.tmp # Copy clipboard contents to a temp file aspell check /tmp/spell.tmp # Run aspell on that file cat /tmp/spell.tmp | xclip # Copy the results back to the clipboard, so that you can paste the corrected text I'm not sure xclip is installed in most distributions. If not, you can install x11-apps package

Get AWS temporary credentials ready to export based on a MFA virtual appliance

You might want to secure your AWS operations requiring to use a MFA token. But then to use API or tools, you need to pass credentials generated with a MFA token. This commands asks you for the MFA code and retrieves these credentials using AWS Cli. To print the exports, you can use: `awk '{ print "export AWS_ACCESS_KEY_ID=\"" $1 "\"\n" "export AWS_SECRET_ACCESS_KEY=\"" $2 "\"\n" "export AWS_SESSION_TOKEN=\"" $3 "\"" }'` You must adapt the command line to include: * $MFA_IDis ARN of the virtual MFA or serial number of the physical one * TTL for the credentials

Watch the size of a directory using figlet

You can substitute /home/$USER with any path you like.

list block devices

Shows all block devices in a tree with descruptions of what they are.

Find usb device in realtime

Using this command you can track a moment when usb device was attached.

gets all files committed to svn by a particular user since a particular date

just change the date following the -r flag, and/or the user name in the user== conditional statement, and substitute yms_web with the name of your module

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)
» commands tagged sniff

Commands tagged sniff (11) the last day the last week the last month all time sorted by date votes

What's this?

Check These Out

Stay in the loop…

Commands tagged sniff (11)

sorted by