I'm redirecting tcpdump output from machine A to machine B. A and B must use a "secure" connection, using VPN or ssh tunnel. I only care about authentication, however: I don't need to protect from sniffing data.

How much overhead should I expect using VPN/ssh compared to a "plain" connection? Bandwidth is a non issue for me, but CPU overhead is.

(If you are wondering the "redirection" happens starting tcpdump with telnet on vpn or ssh on a plain connection)


It shouldn't be an issue at all, you should be able to do this both through SSH or OpenVPN with minor overhead, but you need to filter out from tcpdump the traffic that you're sending to your host B to avoid consuming your bandwidth on dump traces about that traffic.

tcpdump [options here] src host not B or dst host not B should do the trick for you

  • If tshark is used instead of tcpdump the ssh traffic will be filtered out automatically. wireshark.org/docs/man-pages/tshark.html – sciurus Mar 16 '11 at 3:08
  • Yes, but you have to love the recursion! By starting up tcpdump you send some traffic over ssh, which appears on the tcpdump output, which get's sent over ssh, which etc.... so cool. – Decado Mar 16 '11 at 6:16

I use ssh for connecting to amazon's ec2 and running tcpdumps there.

ssh usr@host 'tcpdump "filter"'

ssh uses some cpu load, but it's relatively inconsequential. Occasionally sshd will pop up on 'top'. Just make sure you refine your filter as far as possible to minimise traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.