Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm redirecting tcpdump output from machine A to machine B. A and B must use a "secure" connection, using VPN or ssh tunnel. I only care about authentication, however: I don't need to protect from sniffing data.

How much overhead should I expect using VPN/ssh compared to a "plain" connection? Bandwidth is a non issue for me, but CPU overhead is.

(If you are wondering the "redirection" happens starting tcpdump with telnet on vpn or ssh on a plain connection)

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

It shouldn't be an issue at all, you should be able to do this both through SSH or OpenVPN with minor overhead, but you need to filter out from tcpdump the traffic that you're sending to your host B to avoid consuming your bandwidth on dump traces about that traffic.

tcpdump [options here] src host not B or dst host not B should do the trick for you

share|improve this answer
    
If tshark is used instead of tcpdump the ssh traffic will be filtered out automatically. wireshark.org/docs/man-pages/tshark.html –  sciurus Mar 16 '11 at 3:08
    
Yes, but you have to love the recursion! By starting up tcpdump you send some traffic over ssh, which appears on the tcpdump output, which get's sent over ssh, which etc.... so cool. –  Decado Mar 16 '11 at 6:16
add comment

I use ssh for connecting to amazon's ec2 and running tcpdumps there.

ssh usr@host 'tcpdump "filter"'

ssh uses some cpu load, but it's relatively inconsequential. Occasionally sshd will pop up on 'top'. Just make sure you refine your filter as far as possible to minimise traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.