Convert $SSH_CONNECTION to pcap filter

s4pf.sh

#!/bin/sh

test -n "$SSH_CONNECTION" || {
  echo "No SSH_CONNECTION defined." >&2
  echo "Example usage: ssh host dumpcap -P -i eth0 -f '\"not \$(${0##*/})\"' -w - | wireshark -k -i -" >&2
  exit 1
}

read h1 p1 h2 p2 <<EOF
$SSH_CONNECTION
EOF

echo "((host $h1 and port $p1) and (host $h2 and port $p2))"