This solution involves WSL2, but will work just fine for the Windows version of Wireshark.
Basically you run the following in WSL2:
ssh user@server 'tcpdump -U -i eth0 -w -' | /mnt/c/Program\ Files/Wireshark/Wireshark.exe -k -i -
Given that Wireshark is installed in the default location. Adjust to your requirements and environment.
You want to use tee instead of cat.
tee - read from standard input and write to standard output and
qemu-img convert -f raw -O vmdk /dev/sda1 - | ssh foo@bar "tee /home/foo/foobar.vmdk > /dev/null"