Post #1291303
2026-04-17 13:14 UTC
You want to inspect traffic on a remote host but with the convenience of a Wireshark running locally?
May I share this snippet with you? :)
ssh <host> sudo tcpdump \
-i <interface> -U \
-w - "not port 22" | wireshark -i - -k
(this is for passwordless sudo accounts - not sure how this behaves with required sudo passwords)
Replies (1)
-
@uhei@chaos.social 2026-04-17 14:20
@hukl@chaos.social In case you didn't know: you can also do this directly in Wireshark using the sshdump extcap interface.