How do you stream a tcpdump capture from a remote Linux server over SSH into Wireshark on your workstation, and why does -U matter?

## Why stream instead of copying a file For a short interactive investigation it is convenient to watch packets arrive in Wireshark on your own workstation, without installing a GUI on the server or copying files back and forth. The usual pattern pipes tcpdump's output through SSH into Wireshark: ``` ssh [email protected] "sudo tcpdump -i eth0 -U -w - 'not port 22'" | wireshark -k -i - ``` ## What each piece does - `-w -` makes tcpdump write **raw pcap** to standard output instead of printing decoded lines. Wireshark reads only pcap or pcapng from a pipe, never tcpdump's text. - `-U` (`--packet-buffered`) makes the `-w` output **packet-buffered**: each packet is written to the pipe as soon as it is saved. Without it, output to a file or pipe is buffered, and the man page warns that a reader may not see packets for an arbitrary amount of time; on a quiet filter that can be minutes. - `wireshark -i -` reads the capture from **standard input** ("-" is the documented pipe name), and `-k` starts the capture session at once instead of waiting at the start screen. - tcpdump's own messages ("listening on eth0 ...") go to **standard error**, which SSH carries to your terminal, so they do not corrupt the pcap stream. ## The traps 1. **Capturing your own SSH session.** Each packet the remote tcpdump captures is sent back over the SSH connection, which creates new packets on the same interface, which are captured in turn. Exclude the session in the capture filter, with `not port 22` or, more precisely, the connection's own address and port. Wireshark's automatic remote-traffic filter applies only when Wireshark itself runs in a remote session; it does nothing for a remote tcpdump. 2. **sudo that wants a password.** The remote command has no terminal and its standard output is the capture stream, so an interactive password prompt cannot work. Use a sudo rule that does not prompt for this command, or a capture account given the privilege it needs; how that grant works is a separate subject. 3. **`-l` instead of `-U`.** `-l` line-buffers standard output for piping *printed* text into `tee` or `grep`. With binary pcap on standard output it would flush only when a newline byte happens to occur, not at packet boundaries; `-U` is the option documented for `-w` output. 4. **Bandwidth.** The stream crosses the network at the capture rate. A capture filter and a shorter snapshot length (`-s`) keep it manageable; a congested SSH link backs up into the remote capture buffer and shows up as kernel drops. 5. **Cleanup.** Closing Wireshark closes the pipe; confirm on the server that tcpdump has exited rather than assuming it. ## Checking the stream is healthy - Your terminal shows tcpdump's start line on standard error, such as `tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes`; if it never appears, the remote command did not start (often sudo). - Wireshark's packet count should grow steadily; bursts after long pauses point to a missing `-U`. - When you stop, the end-of-capture summary, including packets dropped by kernel, also arrives on your terminal; read it before trusting gaps in what you saw. ## Stream or file? | Situation | Prefer | |---|---| | Minutes of interactive debugging at a modest rate | streaming over SSH | | Hours or days waiting for an intermittent fault | rotating files on the server (`-C` with `-W`), copied later | | A high-rate link or a slow path to your workstation | a filtered, headers-only capture to a local file | | Evidence that must be kept | a file, with a checksum and a record of the command | ## Variations that keep the same mechanism - Capturing on a different interface or with `-i any` changes nothing about the pipe; the pcap header tells Wireshark the link type. - Wireshark also ships an `sshdump` component that runs a remote capture over SSH from the GUI; it is the same idea packaged as a capture interface. - If you only need text, skip Wireshark: `ssh host "sudo tcpdump -n -l -i eth0 'tcp port 5432'"` prints lines as they arrive, and here `-l` is the right flag.