{"id":390,"date":"2012-07-21T22:51:36","date_gmt":"2012-07-22T04:51:36","guid":{"rendered":"http:\/\/csmartonline.com\/blog\/?p=390"},"modified":"2012-07-21T23:26:06","modified_gmt":"2012-07-22T05:26:06","slug":"using-ssh-wireshark-and-tshark-to-remotely-analyze-packets","status":"publish","type":"post","link":"http:\/\/csmartonline.com\/blog\/2012\/07\/21\/using-ssh-wireshark-and-tshark-to-remotely-analyze-packets\/","title":{"rendered":"Using SSH, Wireshark and tshark to remotely analyze packets&#8230;"},"content":{"rendered":"<p>At home I use ClearOS (free) as my firewall\/gateway. The one thing that ClearOS lacks is a graphical packet analyzer. However, the combined use of SSH, Wireshark and tshark solves this problem perfectly.<\/p>\n<p>Our first step is to setup a passwordless SSH environment on our <strong>local host<\/strong>. To do this, we just need to follow three simple steps:<\/p>\n<p>1. Create the public and private keys on our <strong>local host<\/strong><\/p>\n<pre class=\"snippet-code\">$ssh-keygen<\/pre>\n<p>2. Copy the public key to the <strong>remote host<\/strong><\/p>\n<pre class=\"snippet-code\">$ ssh-copy-id -i ~\/.ssh\/id_rsa.pub remote-host-ip<\/pre>\n<p>3. Login to the <strong>remote host<\/strong> without a password to verify it worked<\/p>\n<pre class=\"snippet-code\">$ssh root@remote-host-ip<\/pre>\n<p>Now that we have a passwordless SSH environment and are logged in, we can move on to installing tshark on our <strong>remote host<\/strong>. On ClearOS, we have to do this by installing the &#8216;wireshark&#8217; package:<\/p>\n<pre class=\"snippet-code\">$yum install wireshark<\/pre>\n<p>Next we need to install Wireshark on our <strong>local host<\/strong> (I use Ubuntu):<\/p>\n<pre class=\"snippet-code\">$sudo apt-get install wireshark<\/pre>\n<p>Great! Now it&#8217;s time to login to our <strong>remote host<\/strong> using SSH, issue a command to start tshark and write the captured packets back to stdout which is then piped into Wireshark on our <strong>local host<\/strong>. Don&#8217;t worry. Thanks to our above preparations, we can do this all in one easy command:<\/p>\n<pre class=\"snippet-code\">$ssh root@remote-host-ip 'tshark -f \"port !22\" -i any -w -' | wireshark -k -i -<\/pre>\n<p>That&#8217;s it! After issuing this command, you should be looking at the traffic of the <strong>remote host<\/strong>.<\/p>\n<p>For a list of other one-liner commands that accomplish the same as the above, please visit <a href=\"http:\/\/www.commandlinefu.com\/commands\/view\/4373\/analyze-traffic-remotely-over-ssh-w-wireshark\">http:\/\/www.commandlinefu.com\/commands\/view\/4373\/analyze-traffic-remotely-over-ssh-w-wireshark<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>At home I use ClearOS (free) as my firewall\/gateway. The one thing that ClearOS lacks is a graphical packet analyzer. However, the combined use of SSH, Wireshark and tshark solves this problem perfectly. Our first step is to setup a &hellip;<\/p>\n<p class=\"read-more\"><a href=\"http:\/\/csmartonline.com\/blog\/2012\/07\/21\/using-ssh-wireshark-and-tshark-to-remotely-analyze-packets\/\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[110,45,53,65,30,115,111,112,41,113,109,114,108,107],"class_list":["post-390","post","type-post","status-publish","format-standard","hentry","category-tiptrick","tag-analyze","tag-clearos","tag-filter","tag-firewall","tag-interface","tag-network","tag-packet","tag-packets","tag-port","tag-remote","tag-ssh","tag-traffic","tag-tshark","tag-wireshark"],"_links":{"self":[{"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/posts\/390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/comments?post=390"}],"version-history":[{"count":16,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/posts\/390\/revisions"}],"predecessor-version":[{"id":406,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/posts\/390\/revisions\/406"}],"wp:attachment":[{"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/media?parent=390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/categories?post=390"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/csmartonline.com\/blog\/wp-json\/wp\/v2\/tags?post=390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}