Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark?

When in capture option I select remote interface and enter my remote ip show me error.code(10061). What should I do?

share|improve this question
You can only sniff traffic that your network interface is seeing. If the network is switched packets to the remote machine will not be sent to you. BTW: try to improve your acceptance rate. – Matteo Feb 22 '12 at 6:23

On Linux and OSX you can achieve this by running tcpdump over ssh and having wireshark listen on the pipe.

  1. Create a named pipe:

    $ mkfifo /tmp/remote

  2. Start wireshark from the command line

    $ wireshark -k -i /tmp/remote

  3. Run tcpdump over ssh on your remote machine and redirect the packets to the named pipe:

    $ ssh root@firewall "tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote


share|improve this answer
Hehe, nice catch. – Marki Aug 10 '13 at 10:47
Absolutely genius! Thanks a lot for that nifty trick – Patryk Dec 18 '15 at 10:17

One approach is to use what's called a mirror or span port on your switch. If your switch isn't inteligent enough you can also put a small hub inbetween the switch/host-to-capture connection. You connect a physical link from your listening host to that port/hub and then you can see all the traffic crossing the device. Alternatively, you'll need to install your packet capture software in a more strategic location in your network like a border firewall/router.

share|improve this answer

You can use a file descriptor to connect to and receive the packets by ssh and pipe it to wireshark locally:

wireshark -i <(ssh root@firewall tcpdump -s 0 -U -n -w - -i eth0 not port 22)

You wireshark will open and show you the "Interface" like /dev/fd/63, which is the file descriptor containing data from the remote system.

share|improve this answer

You can only sniff traffic that makes it to you. So Joe A going to Joe B never comes near your PC, so you can't see it.

Only way is for you to get to the traffic or get the traffic to you. To get to the traffic requires a connection to a router or good switch or hub somewhere in the middle of their connection. To get the traffic to you, you'll need to ARP poison some of the switches so they think your them.

share|improve this answer

see info on setting up the remote computer, to allow your local machine to connect and capture

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Oct 21 '12 at 2:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.