Skip to content

Instantly share code, notes, and snippets.

@quyenlv

quyenlv/remote-capture-packet.rst

Last active December 28, 2018 10:08
Show Gist options
  • Save quyenlv/ad31a0ba307d7f5e04c0691889a40702 to your computer and use it in GitHub Desktop.
Save quyenlv/ad31a0ba307d7f5e04c0691889a40702 to your computer and use it in GitHub Desktop.
Download ZIP
Remote capturing packet with tcpdump and wireshark
Raw
remote-capture-packet.rst

Topology

+------------------+                    +----------------------+
|   Local host     |  tcpdump over ssh  |    Remote Host       |
|                  |--------------------|                      |\ eth0
| +--------------+ |--------------------|                      |/
| |   Wireshark  | |                    |  tcpdump -i eth0...  |
| |--------------| |                    +----------------------+
| |              | |
| |              | |
| +--------------+ |
|                  |
+------------------+

Remote Host

  • Allow to run tcpdump without entering password, by sudo visudo:
username ALL = (ALL) NOPASSWD: /usr/sbin/tcpdump

Local Host

  • Create a named pipe:
mkfifo /tmp/remote
  • Start wireshark from the command line:
wireshark -k -i /tmp/remote
  • Run tcpdump over ssh on your remote machine and redirect the packets to the named pipe:
ssh username@remote_host_ip "sudo tcpdump -s 0 -U -n -w - -i eth0 port 53" > /tmp/remote
  • Test by performing ping google.com on the remote machine, you will see the DNS packets in remote machine's Wireshark.

Reference

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment