analyze traffic remotely over ssh w/ wireshark

ssh root@server.com "tcpdump -i INTERFACE_NAME -U -nnn -s0 -w - 'port 80'" | /cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -N mnNtCd -k -i -

Commandline for windows + cygwin with specific interface and resolved ip.

By: artembeloglazov

2016-03-02 13:42:29

ssh ssh windows cygwin wireshark capture sniff

8 Alternatives + Submit Alt

analyze traffic remotely over ssh w/ wireshark

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -
This is sample output - yours may be different.
31

ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -

markdrago · 2009-12-17 23:03:24 54
analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering.
This is sample output - yours may be different.
13

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

abb · 2010-10-28 09:02:39 7
Sniffing network to generate a pcap file in CLI mode on a remote host and open it via local Wireshark ( GUI ).

Then hit ^C to stop, get the file by scp, and you can now use wireshark like this : wireshark /tmp/sniff.pcap If you have tshark on remote host, you could use that : wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22) The last snippet comes from http://wiki.wireshark.org/CaptureSetup/Pipes Show Sample Output
This is sample output - yours may be different.
```
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
265 packets captured
265 packets received by filter
0 packets dropped by kernel
```
6

tcpdump -v -i <INTERFACE> -s 0 -w /tmp/sniff.pcap port <PORT> # On the remote side

sputnick · 2009-12-17 22:08:30 4
analyze traffic remotely over ssh w/ wireshark

Please check out my blog article on this for more detail. http://jdubb.net/blog/2009/08/07/monitor-wireshark-capture-real-time-on-remote-host-via-ssh/
This is sample output - yours may be different.
3

mkfifo /tmp/fifo; ssh-keygen; ssh-copyid root@remotehostaddress; sudo ssh root@remotehost "tshark -i eth1 -f 'not tcp port 22' -w -" > /tmp/fifo &; sudo wireshark -k -i /tmp/fifo;

Code_Bleu · 2010-01-05 14:40:06 4
analyze traffic remotely over ssh w/ wireshark

commandline for mac os x
This is sample output - yours may be different.
3

ssh user@server.com sudo tcpdump -i eth0 -w - 'port 80'| /Applications/Wireshark.app/Contents/Resources/bin/wireshark -k -i -

bkendinibilir · 2012-01-23 18:16:22 4

What Others Think

seofox · 141 weeks and 4 days ago

where to get shrooms dried mushrooms african pyramid mushroom african transkei mushroom albino penis envy b+ mushrooms blue meanies mushroom brazilian magic mushroom burmese mushroom golden teacher mushroom ko samui super strain malabar coast martinique mexican mushroom mushroom british columbia super thai mushroom nepalese chitwan mushroom penis envy texas penis envy 6 texas yellow caps vietnamese white jedi mind fuck tri coloured ecuadorian mushroom magic mushsroom edibles mexican cubensis psychedelic chocolate bar where to get shrooms dried mushrooms african pyramid mushroom african transkei mushroom albino penis envy b+ mushrooms blue meanies mushroom brazilian magic mushroom burmese mushroom golden teacher mushroom ko samui super strain malabar coast martinique mexican mushroom mushroom british columbia super thai mushroom nepalese chitwan mushroom penis envy texas penis envy 6 texas yellow caps vietnamese white jedi mind fuck tri coloured ecuadorian mushroom magic mushsroom edibles mexican cubensis psychedelic chocolate bar midnight mint psychedelic chocolate bar origin mango psilo gummies 0.25g-1g origin strawberry psilo gummies 0.25g-1g penis envy psychedelic chocolate bar psilocybin cube gummies vegan dark chocolate psychedelic chocolate bar microdoses brain capsules 50mg-200mg chill capsules 50mg-200mg clarity capsules 50mg-200mg health capsules 50mg-200mg love capsules 50mg-200mg mood capsules 50mg-200mg pure capsules 50mg-200mg social capsules 30 pack 350mg social capsules 5 pack 350mg buy weed online without medical card marijuana flowers types of concentrates cannabis cartridges buy edibles online legal marijuana shatter cannabis wax marijuana hash buy psychedelic online tinctures for anxiety cannabis seeds bank weed smoker accessories birthday cake kush acdc strain ace killer og strain ak 47 strain alaskan thunder fuck alien kush strain ambrosia kush strain atomik moon rocks cbd 40.57% atomik moon rocks diamond 58.77% banana og strain bc big bud strain birthday cake kush blue cheese strain blue dream og kush blue moonrock kush blue rhino strain blueberry kush strain bruce banner strain cannabis trim cherry pie strain cannatonic strain citrix strain dark star kush durban poison strain eleven roses strain g13 haze strain gelato strain girl scout cookies flavors girl scout cookies online granddad purple strain grape nana weed strains grape pie strain green crack strain guava kush strain hawaiian skunk jack herer strain mendo breath weed mighty mango mr nice guy weed blue mystic strain northern lights strain northern lights moon rock platinum og kush gas og strain pink og kush platinum hawaiian strain pootie tang strain purple mimosa strain purple white widow strain smart buds sour diesel weed strain sour moonrock strain space monkey tins strawberry banana weed sun rocks super citrus haze strain super silver haze wedding cake strain exotic white widows strain zombie kush strain all natural pistachio crunch apple fritter vape cartridge aura edibles gummy-candy banana og cartridge birthday cake dank vape pen cartridg biscotti vape cartridge blackberry kush cartridge bliss edibles 300mg thc blue dream cartridge 180mlg berry blue raspberry 500mg-chocolate chip- cookies atomic wheelchair activated thc distillate strike gold blue dream shatter bubba kush shatter cbd dried organic ginger blueberry kush vape cartridges chemdawg shatter 50mg choco chunk cookies cookies and cream vape delta 8 thc capsules do-si-dos cartridges durban poison vape cartridge eds and bills edible candy bags forbidden fruit cartridge fruity pebbles cartridge gelato cartridge 1000mg girl scout cookies shatter girl scout cookies wax gorilla glue #4 wax gorilla glue cartridge gorilla glue shatter grand daddy purple kush wax gsc cartridge hardcore og cartridge jack herer cartridge jack herer wax jet fuel cartridge juicy melon cartridge khalifa kush shatter kosher kush cartridge labanese camel hash lemon berry cartridge

johnson20007 · 141 weeks and 1 day ago

seofox · 122 weeks and 4 days ago

Amazing! This blog looks just like my old one! It's on a completely different subject but it has pretty much the same layout and design. Wonderful choice of colors! Pug Puppies for Sale Near Me PUG PUPPY FOR SALE NEAR ME PUG PUPPIES FOR SALE pug puppies for sale in kentucky Pug Puppies for Sale Under $500 Near Me pug puppies for sale in texas pugs puppies for sale teacup pugs for sale pug puppies for sale by owner pug puppies ohio

rahimhh21 · 112 weeks and 5 days ago

AnthonyLewis9201 · 107 weeks ago

Perfecthomepugs · 102 weeks and 6 days ago

Princesmith · 96 weeks and 1 day ago

SENSA838 selaku situs agen slot online terbaik no 1 di Indonesia akan selalu menyediakan layanan yang terbaik dan bisa memuaskan para member setia kami. Diantara nya seperti memberikan informasi mengenai daftar provider slot gacor dan terpopuler saat ini. SENSA838 Bukan hanya sekedar memberikan statement sebagai situs tergacor 2022 saat ini, kami membuktikan dengan memberikan jaminan garansi gacor 100% atau biasa di sebut garansi kekalahan 100%. Yang di mana apabila member baru deposit dan mengalami kekalahan pertamanya maka member berhak mengklaim garansi kekalahan 100% sesuai dengan syarat dan ketentuan yang berlaku. Menarik kan ? Main slot kalah dan bisa klaim kembali saldo nya. Promo ini hanya berlaku untuk member yang baru melakukan deposit untuk pertama kali nya. Cara klaim nya juga sangat mudah sekali. Member hanya perlu melapor ke CS Livechat SENSA838 yang bertugas 24 jam dimana fitur klaim garansi nya terdapat di bagian pojok kanan bawah di halaman situs kami.

missmawar222 · 94 weeks and 3 days ago

pugpuppies95 · 65 weeks and 2 days ago

liltommy · 65 weeks and 1 day ago

liltommy · 64 weeks and 6 days ago

donperi1 · 58 weeks ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Similar Commands

HTTP GET request on wireshark remotly

Remotely sniff traffic and pass to snort

netcat - send tar archive remotely (sending side)

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)