Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This works:

tethereal -i eth0 -w /root/mycapture.pcap

but it captures every packet. I only need to capture DNS requests. Is this possible? The server is Linux.

Other thing is: is it possible to have the file saved over a network to another computer? The server only has a small hard drive that's not big enough for the capture file.


share|improve this question
up vote 1 down vote accepted

Specify a capture filter using -f "port 53".

Side note: It's tshark now, not tethereal anymore.

To capture locally but store the data on a remote server, use - or /dev/stdout as the output file, and pipe the command to ssh:

tshark -i eth0 -f "port 53" -l -w - | ssh otherhost "cat > foo.pcap"

tcpdump -i eth0 -f "port 53" -l -w - | ssh otherhost "cat > foo.pcap"

You can also do the opposite – capture on a remote server but store data locally:

ssh otherhost "tshark -i eth0 -f "port 53" -l -w -" > foo.pcap

ssh otherhost "tcpdump -i eth0 -f "port 53" -l -w -" > foo.pcap

Note: Always specify a capture filter when storing data like this. If you don't, each packet will cause an infinite loop.

share|improve this answer
The man page for tethereal and the Wireshark User Guide mention filters that are applied by default when run via SSH. In the first case (storing to remote server), this won't apply, but in the second case? – Daniel Beck Jan 28 '12 at 14:20
Thanks, that is capturing dns now. However i'm confused about getting the file saved on my local computer. I am using ssh to get into a server i own from a windows 7 laptop. How do i get the file to be sent to my laptop from the server as it's being captured? – thebigapplee Jan 28 '12 at 14:30
@DanielBeck: Thanks, didn't know that. – grawity Jan 28 '12 at 14:33
@thebigapplee: Use the second method ("capture on a remote server"). If using PuTTY, replace ssh with plink. – grawity Jan 28 '12 at 14:34
and i replace 'otherhost' with what, how will it find my computer? – thebigapplee Jan 28 '12 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.