55

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark?

When in capture option I select remote interface and enter my remote ip show me error.code(10061). What should I do?

2
  • 6
    You can only sniff traffic that your network interface is seeing. If the network is switched packets to the remote machine will not be sent to you. BTW: try to improve your acceptance rate.
    – Matteo
    Feb 22, 2012 at 6:23
  • For the context of your question & use case of that exact particular feature, you need to run a server/service/daemon on the remote machine. Best explained in this answer serverfault.com/a/389448/256793
    – David
    Nov 17, 2023 at 0:23

9 Answers 9

72

On Linux and OSX you can achieve this by running tcpdump over ssh and having wireshark listen on the pipe.

  1. Create a named pipe:

    $ mkfifo /tmp/remote

  2. Start wireshark from the command line

    $ wireshark -k -i /tmp/remote

  3. Run tcpdump over ssh on your remote machine and redirect the packets to the named pipe:

    $ ssh root@firewall "tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote

Source: http://blog.nielshorn.net/2010/02/using-wireshark-with-remote-capturing/

4
  • Is it possible to catch packets going through a router on the router itself this way, or is that something impossible?
    – inf3rno
    Jun 15, 2017 at 22:41
  • This is great. My 2c: allowing [ssh root] is generally not advised, but you can temporarily toggle it on by adding root to the [Match User] line in /etc/ssh/sshd_config.
    – moodboom
    Jan 28, 2018 at 17:03
  • This is not working for me, ssh root@{MY_VPS_IP} -p 27922 "tcpdump -s 0 -U -n -w - -i eth0 not port 27922" > /tmp/remote could you tell me why?
    – Phoenix
    May 9, 2018 at 21:32
  • @infmo if the router can run tcpdump directly then yes it should be possible. Mine doesn't the space to install tcpdump. Not uncommon for low end routers. Sep 7, 2018 at 15:10
40

I use this oneliner as root. Is very useful!

ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i -

The last - before de | is the redirection of that output and is used to standard input by wireshark. The -k option in wireshark means "start inmidiately sniffing

3
  • 1
    Best first answer I have ever seen.
    – sjas
    Jan 31, 2017 at 18:35
  • Had to modify the tcpdump a bit for running on OpenBSD since it lacks -U among other things: tcpdump -s 65536 -i em0 -w - 'not port 22'
    – pipe
    Apr 12, 2020 at 14:56
  • Very nice command! Thank you. I can even capture canbus on an embedded linux with sudo ssh root@<IP> tcpdump -U -s0 -i can0 -w - | sudo wireshark -k -i - Nov 29, 2020 at 20:08
11

One approach is to use what's called a mirror or span port on your switch. If your switch isn't inteligent enough you can also put a small hub inbetween the switch/host-to-capture connection. You connect a physical link from your listening host to that port/hub and then you can see all the traffic crossing the device. Alternatively, you'll need to install your packet capture software in a more strategic location in your network like a border firewall/router.

1
7

You can use a file descriptor to connect to and receive the packets by ssh and pipe it to wireshark locally:

wireshark -i <(ssh root@firewall tcpdump -s 0 -U -n -w - -i eth0 not port 22)

You wireshark will open and show you the "Interface" like /dev/fd/63, which is the file descriptor containing data from the remote system.

5

Under RHEL, konrad's answer didn't work for me because tcpdump requires root, and I only have sudo access. What did work was to create an extra remote fifo that I can read from:

remote:~$ mkfifo pcap
remote:~$ sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22 > pcap

and send the data by a separate connection:

local:~$ mkfifo pcap
local:~$ ssh user@host "cat pcap" > pcap

and finally start Wireshark

local:~$ wireshark -k -i pcap
2

see info on setting up the remote computer, to allow your local machine to connect and capture

http://wiki.wireshark.org/CaptureSetup/WinPcapRemote

4
1

You can only sniff traffic that makes it to you. So Joe A going to Joe B never comes near your PC, so you can't see it.

Only way is for you to get to the traffic or get the traffic to you. To get to the traffic requires a connection to a router or good switch or hub somewhere in the middle of their connection. To get the traffic to you, you'll need to ARP poison some of the switches so they think your them.

1

In addition to previous answers, version with netcat nc might be useful as well:

Remote host:

mkfifo /tmp/mypcap.fifo

tcpdump -i em0 -s 0 -U -w - > /tmp/mypcap.fifo

nc -l 10000 < /tmp/mypcap.fifo

Local host:

wireshark -ki <(nc 192.168.1.1 10000)

Note about this method: It makes unsecure port open to all interfaces, so make sure to filter incoming connections with firewall rules.

1

If you have no root access via ssh on your host being sniffed to, like on a raspberrypi, and for good reason you don't want to enable it or you simply can't do it, for whatever reason, there is a slightly different approach of @ctaglia (alternative to answer to that from @Dan).

What we do here is to pipe the sudo password into the sudo command which executes its argument tcpdump. This enables root privileges for tcpdump on the host to be sniffed remotely.

Replace content in angle brackets <> to your needs.

Port is automatically chosen by protocol specification, so not necessarily required. And the network interface (eth0) in not necessarily eth0. It depends on its type and count off different interfaces. You can check and find the proper one via $ ip link.

$ ssh <user>@<your_host_to_sniff> "echo <sudo_passwd_of_host_to_sniff> | sudo -S tcpdump -U -s0 not port 22" -i eth0 -w - | sudo wireshark -k -i -

WARNING

Plain passwords on the command line are a security risk. Do it only on your very private machine and clear you history after then via $ history -c

Original resource

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .