Howto – Remote tcpdump capture with Wireshark on Windows

For diagnostic purposes, it migt be sometimes necessary to perform a remote capture of network traffic on some linux box.   It comes in handy that we can do this remotely from a laptop running windows and wireshark, this way we don’t need to, first create a packet capture file and transfer this to our computer.  Instead, this procedure connects over ssh to the remote linux, starts tcpdump, redirects the output in realtime over the ssh connection to our windows machine and inputs this into wireshark.

The tools we are using for this on Windows is plink.exe (known from the putty suite of tools), tcpdump and Wireshark.

Before we start monitoring, we will need to give tcpdump permission to capture raw packets:

By logging in with username and password:

  • “C:\Program Files (x86)\PuTTY\plink.exe” -ssh -t -pw password sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

By logging in with a key:

  • “C:\Program Files (x86)\PuTTY\plink.exe” -ssh -t -i “S:\” sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

To monitor your remote Linux box, connecting with a username and password:

  • “C:\Program Files (x86)\PuTTY\plink.exe” -ssh -pw password tcpdump -n -nn -s 0 -U -w – -i eth0 | “C:\Program Files\Wireshark\wireshark.exe” -i – -k

To monitor your remote Linux box, connecting with a key:

  • “C:\Program Files (x86)\PuTTY\plink.exe” -ssh -i “S:\” tcpdump -n -nn -s 0 -U -w – -i eth0 | “C:\Program Files\Wireshark\wireshark.exe” -i – -k

Published by

Ronny Van den Broeck

I'm a network and system engineer for more than 20 years now. During this period I became a pro in hunting down one's and zero's, with an eager mindset to help people accomplish the same or abstract them away from the matrix.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s