0

I'm redirecting tcpdump output from machine A to machine B. A and B must use a "secure" connection, using VPN or ssh tunnel. I only care about authentication, however: I don't need to protect from sniffing data.

How much overhead should I expect using VPN/ssh compared to a "plain" connection? Bandwidth is a non issue for me, but CPU overhead is.

(If you are wondering the "redirection" happens starting tcpdump with telnet on vpn or ssh on a plain connection)

Improve this question

2 Answers 2

Reset to default
2

It shouldn't be an issue at all, you should be able to do this both through SSH or OpenVPN with minor overhead, but you need to filter out from tcpdump the traffic that you're sending to your host B to avoid consuming your bandwidth on dump traces about that traffic.

tcpdump [options here] src host not B or dst host not B should do the trick for you

Improve this answer
2
  • If tshark is used instead of tcpdump the ssh traffic will be filtered out automatically. wireshark.org/docs/man-pages/tshark.html
    – sciurus
    Mar 16, 2011 at 3:08
  • Yes, but you have to love the recursion! By starting up tcpdump you send some traffic over ssh, which appears on the tcpdump output, which get's sent over ssh, which etc.... so cool.
    – Decado
    Mar 16, 2011 at 6:16
1

I use ssh for connecting to amazon's ec2 and running tcpdumps there.

ssh usr@host 'tcpdump "filter"'

ssh uses some cpu load, but it's relatively inconsequential. Occasionally sshd will pop up on 'top'. Just make sure you refine your filter as far as possible to minimise traffic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .