NOTES Sshdump is part of the Wireshark distribution.It will modify windows registry files for proper work SEE ALSO wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1) NOTE: To stop capturing CTRL+C/kill/terminate application. remote-capture-command='sudo tcpdump -i eth0 -U -w -' remote-capture-command='dumpcap -i eth0 -P -w -' remote-username user -remote-filter 'not port 22' Sshdump -extcap-interface=ssh -fifo=/tmp/ssh.pcap -capture -remote-host 192.168.1.10 The command must be able to produce a PCAP stream written to STDOUT.

The remote network interface to capture from.Ī custom remote capture command that produces the remote stream that is shown in The path to a private key for authentication. Stored in plaintext and visible to all users on this system. The password to use (if not ssh-agent and pubkey are used). The address of the remote host for capture. Save captured packet to file or send it through pipe. Start capturing from specified interface and write raw packet data to the location List configuration options of specified interface. $ ssh '/sbin/dumpcap -i IFACE -P -w -f 'not port 22'' > FILE & $ $ ssh -p 22222 'tcpdump -U -i IFACE -w -' > FILE & $ wireshark FILE The feature is functionally equivalent to run commands like The requirement is that the capture executable must have the capabilities to capture from Sshdump -extcap-interfaces sshdump -extcap-interface= -extcap-dlts sshdump -extcap-interface= -extcap-config sshdump -extcap-interface= -fifo= -capture -remote-host=myremotehost -remote-port=22 -remote-username=user -remote-interface=eth2 -remote-capture-command='tcpdump -U -i eth0 -w-' DESCRIPTION Sshdump is a extcap tool that allows one to run a remote capture tool in a SSH connection. Sshdump - Provide interfaces to capture from a remote host through SSH using a remote

Provided by: wireshark-common_2.4.5-1_amd64

Wireshark capture filter for ssh