Awesome

remote-wireshark

Simple script to run wireshark locally getting traffic dump from a remote host through ssh + tcpdump.

It assumes you have sudo working on the remote host and passwordless access to tcpdump through sudo.

./remote-wireshark.sh "[SSH CREDENTIALS AND EXTRA OPTIONS]" "[TCPDUMP EXTRA OPTIONS]"

Showing web traffic on eth0 for user@host:

./remote-wireshark.sh "user@host" "-i eth0 port 80"

Connecting though a different port to sniff google dns traffic:

./remote-wireshark.sh "-p 9999 user@host" "-i eth1 host 8.8.8.8 or host 8.8.4.4"