2

I have a remote containter that I log on into using SSH, and want to capture its traffic with Wireshark.

In mac or linux environemts I could write

ssh remote-ssh-host 'sudo tcpdump -U -i eth1 -w -' | wireshark -i - -k

Does someone know the windows equivalent?

1 Answer 1

1

The CaptureSetup/Pipes article has some named FIFO examples for Windows, and mentions that Wireshark supports reading the capture from a TCP connection, not only from a pipe.

  1. Start the capture and pipe it into a TCP listener:

    ssh -L 12345:127.0.0.1:12345 root@host "socat -u exec:'tcpdump -U -w - -i eth1' tcp-l:12345,bind=127.0.0.1"
    

    or

    ssh -L 12345:127.0.0.1:12345 root@host "tcpdump -U -w - -i eth1 | nc -v -l -s 127.0.0.1 -p 12345"
    
  2. Separately, start Wireshark:

    "C:\Program Files\Wireshark\Wireshark.exe" -k -i [email protected]:12345
    

If you don't have OpenSSH on Windows, but do have PuTTY, then replace ssh with plink (or possibly plink -no-antispoof); all other options remain the same.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .