Using Wireshark remotely
If you want to sniff traffic remotely, but you want to have the confort of using the Wireshark GUI, you just have to use tcpdump piped to wireshark:
ssh root@$remote_host tcpdump -nUs 0 -i $intf -w- | wireshark -ki -
$remote_host is the IP address or hostname of the remote machine you want to login with SSH.
$intf is the remote interface you want to sniff.
blog comments powered by Disqus