4 ms·

Many times I Google something like "Wireshark from remote ssh" and I manage to stream the remote tshark stream to my local Wireshark UI. However, this is very i

Many times I Google something like "Wireshark from remote ssh" and I manage to stream the remote tshark stream to my local Wireshark UI. However, this is very interesting and welcoming project, and I guess it will make it simpler in many use cases

toast0 3y ago
If you're ok installing stuff on the remote side, which you'd need to be to run this anyway, I'd expect wireshark to work well with X forwarding. This looks nicer, but X forwarding is a generic solution to displaying GUIs locally while running them remotely.
- bdd8f1df777b 3y ago
  My remote machine, a cheap VPS VM, is too weak to support GUI. The network between my machine and VM is also too slow for that.
- theamk 3y ago
  Installing wireshark on non-gui machines brings tons of junk.. just tried this on Ubuntu's minimal container with tshark installed -- and by default, wireshark brings in 206 extra packages, including python3 and systemd. It's a bit better with --no-install-recommends, but still 105 extra packages. termshark, being written in go, has zero (0) extra packages other than tshark.
- Galanwe 3y ago
  > If you're ok installing stuff on the remote side, which you'd need to be to run this anyway It is more likely easier to build / install this on a remote server than to have X11 forwarding. - X11 fwd is often disabled in sshd config, as it introduces a number of backchannels for a compromised server to leak to the client. - If you're working on a remote _server_, it is very unlikely that an X client will be available there. Building an X client & it's dependencies as non-root is a thousand times worst than building such a small TUI. Been there, done that. - Remote X11 is horribly slow, you'll most likely want some more modern variant (x2go & co), which will be a nightmare to build, or tunnel.
imglorp 3y ago
The other way to do it is ssh to remote box, `tcpdump -w foo.pcap` there, then bring it back by scp and you can open it for analysis in full wireshark.
- emmelaich 3y ago
  tshark includes the functionality of tcpdump and more
- gorgonq 3y ago
  You can even let tcpdump write packets to stdout, then pipe directly to your local wireshark and get a live view: ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k makes sense to exclude port 22 from the dump =)
  - ElijahLynn 3y ago
    I've used this method with success! +1
  - silentprog 3y ago
    This works, but you won’t get the interface name in wireshark. If you also require the captured interface you can substitute tcpdump with tshark
- deleted 3y ago
  [deleted]
jamesfmilne 3y ago
Wireshark supports this natively. Look at the `SSH remote capture: sshdump`. https://www.wireshark.org/docs/man-pages/sshdump.html https://www.wireshark.org/docs/man-pages/sshdump.html Wireshark can SSH into the remote machine, perform the capture, then show the packets in your local instance of Wireshark. It's a bit of a nuisance to setup of course, tshark has a bit less friction here, and TUIs are always cool.

toast0 3y ago

If you're ok installing stuff on the remote side, which you'd need to be to run this anyway, I'd expect wireshark to work well with X forwarding. This looks nicer, but X forwarding is a generic solution to displaying GUIs locally while running them remotely.

bdd8f1df777b 3y ago
My remote machine, a cheap VPS VM, is too weak to support GUI. The network between my machine and VM is also too slow for that.
theamk 3y ago
Installing wireshark on non-gui machines brings tons of junk.. just tried this on Ubuntu's minimal container with tshark installed -- and by default, wireshark brings in 206 extra packages, including python3 and systemd. It's a bit better with --no-install-recommends, but still 105 extra packages. termshark, being written in go, has zero (0) extra packages other than tshark.
Galanwe 3y ago
> If you're ok installing stuff on the remote side, which you'd need to be to run this anyway It is more likely easier to build / install this on a remote server than to have X11 forwarding. - X11 fwd is often disabled in sshd config, as it introduces a number of backchannels for a compromised server to leak to the client. - If you're working on a remote _server_, it is very unlikely that an X client will be available there. Building an X client & it's dependencies as non-root is a thousand times worst than building such a small TUI. Been there, done that. - Remote X11 is horribly slow, you'll most likely want some more modern variant (x2go & co), which will be a nightmare to build, or tunnel.

imglorp 3y ago

The other way to do it is ssh to remote box, `tcpdump -w foo.pcap` there, then bring it back by scp and you can open it for analysis in full wireshark.

emmelaich 3y ago
tshark includes the functionality of tcpdump and more
gorgonq 3y ago
You can even let tcpdump write packets to stdout, then pipe directly to your local wireshark and get a live view: ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k makes sense to exclude port 22 from the dump =)
- ElijahLynn 3y ago
  I've used this method with success! +1
- silentprog 3y ago
  This works, but you won’t get the interface name in wireshark. If you also require the captured interface you can substitute tcpdump with tshark
deleted 3y ago
[deleted]

jamesfmilne 3y ago

Wireshark supports this natively. Look at the `SSH remote capture: sshdump`. https://www.wireshark.org/docs/man-pages/sshdump.html https://www.wireshark.org/docs/man-pages/sshdump.html Wireshark can SSH into the remote machine, perform the capture, then show the packets in your local instance of Wireshark. It's a bit of a nuisance to setup of course, tshark has a bit less friction here, and TUIs are always cool.