wireshark capture on remote host ( through ssh tcpdump )

wireshark_remote.sh

#!/bin/bash
# ssh root@yurenchen.com "tcpdump  -w - -U 'host g.cn'"  | sudo wireshark  -k -i -

# tcpdump Capture on remote host (by ssh) & Show packets on local wireshark
#    $remote Need Capture permission
#    $filter is tcpdump capture filter
# example:
#    $ wireshark_remote  root@10.1.1.2  'host yurenchen.com'

wireshark_remote(){
	local remote="$1"
	local filter="$2"

	ssh $remote "tcpdump  -w - -U '$filter'"  | wireshark  -k -i -
}

[ -n "$1" ] && wireshark_remote $@