Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are:

wireshark-devel.x86_64
wireshark.i686
wireshark.x86_64

Some googling shows that I need the wireshark-gnome package.

I'm running Amazon Linux AMI 2012.03. Is it possible to get wireshark-gnome, using yum?

share|improve this question
if you don't find a way, you could always capture some packets into a file with tshark and open the file on another machine with wireshark – Colin Pickard Oct 11 '12 at 22:15
@ColinPickard That's pretty much my current method :) It gets the job done, but I find it much easier to look at a live Wireshark capture than a live command line dump, or in Wireshark after the fact. – Dean Oct 11 '12 at 22:19
how about forwarding the packets over ssh to a local wireshark? howtoforge.com/wireshark-remote-capturing – Colin Pickard Oct 11 '12 at 22:31
@ColinPickard It worked! Well with a little fiddling. I had to change the permissions of tcpdump to 4755. I should also note that for those unfamiliar with tcpdump, the example from the link includes a capture filter (port 53) which you'll probably want to leave out. If you put this as an answer, I'll be happy to mark it as accepted. – Dean Oct 11 '12 at 23:49

1 Answer

up vote 1 down vote accepted

As discussed in the comments, you can forward the packets over ssh and view them live in a local copy of wireshark. The command to do this (on your local machine) will look something like this:

wireshark -k -i <( ssh -l root probe /usr/sbin/tcpdump -i eth0 -w - )
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.