wireshark linux traffic capture limitations

Over 50 different command line flags, limitless possibilities with filterĮxpressions, and its man page, providing only a brief overview of all its

The tcpdump program is an exceptionally powerful tool, but that also makes Included in pfSense® software and is usable from a shell on the console or over Most UNIX and UNIX-like operating system distributions, including FreeBSD. The tcpdump program is a command line packet capture utility provided with

pfSense® software Configuration Recipes.

This mechanism can also be used for tcpdump, but sshdump currently does not support it (see for an alternative script). Then you can capture from it as if it was a local one (behind the scenes it uses ssh + dumpcap). If you have dumpcap installed on the remote server, you can configure the 'sshdump' interface in the interfaces list (set a user and host). Newer versions of Wireshark (since 2.2) however have the 'Extcap' mechanism. For tcpdump you might have to configure a password-less sudo (edit with visudo -f /etc/sudoers/wireshark-tcpdump, add %wireshark ALL = NOPASSWD: /usr/sbin/tcpdump to allow everyone from the 'wireshark' group use password-less sudo for just tcpdump). Typically dumpcap is installed with extra capabilities (see CaptureSetup/CapturePrivileges), so no root is needed. Ssh sudo tcpdump -Z user -i eth0 -p -U -w - 'tcp port 80' | wireshark -i -k -p Quite inconvenient, but here are two examples (see manual pages for explanation of options: dumpcap, wireshark, tcpdump): ssh dumpcap -i eth0 -P -w -f 'tcp port 80' | wireshark -i -k -p On older versions of Wireshark, your only method for remote live captures is a pipe from stdin (with the limitation that you have to restart Wireshark every time you want to restart your capture). Capturing over an encrypted SSH session is the way to go for Linux.

Wireshark on Linux does not support the rpcap method.

Wireshark linux traffic capture limitations