If you want to sniff traffic remotely, but you want to have the confort of using the Wireshark GUI, you just have to use tcpdump piped to wireshark:

ssh root@$remote_host tcpdump -nUs 0 -i $intf -w- | wireshark -ki -

$remote_host is the IP address or hostname of the remote machine you want to login with SSH.
$intf is the remote interface you want to sniff.

blog comments powered by Disqus


26 June 2015