Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are:


Some googling shows that I need the wireshark-gnome package.

I'm running Amazon Linux AMI 2012.03. Is it possible to get wireshark-gnome, using yum?

share|improve this question
if you don't find a way, you could always capture some packets into a file with tshark and open the file on another machine with wireshark – Colin Pickard Oct 11 '12 at 22:15
@ColinPickard That's pretty much my current method :) It gets the job done, but I find it much easier to look at a live Wireshark capture than a live command line dump, or in Wireshark after the fact. – Dean Oct 11 '12 at 22:19
how about forwarding the packets over ssh to a local wireshark? – Colin Pickard Oct 11 '12 at 22:31
@ColinPickard It worked! Well with a little fiddling. I had to change the permissions of tcpdump to 4755. I should also note that for those unfamiliar with tcpdump, the example from the link includes a capture filter (port 53) which you'll probably want to leave out. If you put this as an answer, I'll be happy to mark it as accepted. – Dean Oct 11 '12 at 23:49
up vote 3 down vote accepted

As discussed in the comments, you can forward the packets over ssh and view them live in a local copy of wireshark. The command to do this (on your local machine) will look something like this:

wireshark -k -i <( ssh -l root probe /usr/sbin/tcpdump -i eth0 -w - )
share|improve this answer

This command line working out of box with EC2 CentOS, if you are using Ubuntu just change the ec2-user to Ubuntu:

wireshark -k -i <( ssh -t -i private.pem ec2-user@ec2host "sudo /usr/sbin/tcpdump -i eth0 -w -" )

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .