3 ms·

The other way to do it is ssh to remote box, `tcpdump -w foo.pcap` there, then bring it back by scp and you can open it for analysis in full wireshark.

• emmelaich 3y ago
  tshark includes the functionality of tcpdump and more
• gorgonq 3y ago
  You can even let tcpdump write packets to stdout, then pipe directly to your local wireshark and get a live view: ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k makes sense to exclude port 22 from the dump =)
  • ElijahLynn 3y ago
    I've used this method with success! +1
  • silentprog 3y ago
    This works, but you won’t get the interface name in wireshark. If you also require the captured interface you can substitute tcpdump with tshark
• deleted 3y ago
  [deleted]