Cool set of steps on [WayBack] How I use Wireshark – Julia Evans who uses the combination of tcpdump to dump traffic in pcap files and Wireshark to analyse the pcap files after copying them using scp. On many platforms, Wireshark can also capture the ptrace files for you.
Via: [WayBack] 🔎Julia Evans🔍 on Twitter: “how I use Wireshark https://t.co/j699JXrjaH” which has some nice comments including:
- adding
ptraceto your tool-kit - not needing
scpfor copying, as you can do [WayBack]dumpcapover an existing ssh connection:- You might like this snippet, saves you the need to do the scp dance:
wireshark -k -i <(ssh <IP> "sudo dumpcap -P -w - -f 'not tcp port 22'")
- You might like this snippet, saves you the need to do the scp dance:
–jeroen
The Wiert Corner - irregular stream of stuff 