4 ms·
I use this to run Wireshark on local desktop with live traffic from remote server e.g. excludes port 22/53 ssh root@host tcpdump -U -s0 'not port 22 and not p
by mobilemidget 8y ago
I use this to run Wireshark on local desktop with live traffic from remote server
e.g. excludes port 22/53
ssh root@host tcpdump -U -s0 'not port 22 and not port 53' -w - | wireshark -k -I -
- chatmasta 8y agoYeah, remote debugging is possibly the best part of wireshark. If you can generate a pcap file and stream it to your machine, you can view it in wireshark.
- Kurtz79 8y agoThe first time I used this command to monitor traffic remotely on a headless device it felt like magic. Incredibly useful. You can achieve the same under Windows using putty/plink: plink.exe -ssh -pw password root@host "tcpdump -ni eth0 -s 0 -w - not port 22" | "C:\Program Files\Wireshark\Wireshark.exe" -k -i - Of course you need to have tcpdump as a command line executable in the host.
- d21d3q 8y agoWorth to mention that you can dump traffic from router to your machine and debug network in issues between headless/sshless devices.
- snug 8y agoCurious, why skip DNS traffic when your capturing all other traffic?
- mtve 8y agoseems nobody mentioned rpcapd in this thread - https://github.com/rpcapd-linux/rpcapd-linux https://github.com/rpcapd-linux/rpcapd-linux could be used to see interfaces on remote linux boxes from windows desktop