Skip to content

Instantly share code, notes, and snippets.

@ivand58
Created September 26, 2018 16:29
Show Gist options
  • Select an option

  • Save ivand58/37ebb8cccd4ce54e58b76345408be35f to your computer and use it in GitHub Desktop.

Select an option

Save ivand58/37ebb8cccd4ce54e58b76345408be35f to your computer and use it in GitHub Desktop.
mkfifo /tmp/board;
wireshark -k -i /tmp/board &
ssh root@10.7.6.5 "tcpdump -s 0 -U -n -w - -i lo not port 22" > /tmp/board;
@ivand58
Copy link
Copy Markdown
Author

ivand58 commented Sep 26, 2018

Explanation of our solution:

Following are the steps that we performed on the local machine to pipe the results of tcpdump on the remote machine on the wireshark on the local machine.

First we created a named pipe as follows:
mkfifo /tmp/board;
You can name your pipe anyway you like and place it in any folder you wish. We used /tmp as our pipe is a temporary construct that we do not care to preserve across time/restarts.
Then we started wireshark from a terminal so that we could pass as capture interface the named pipe we just created using the -i /tmp/board parameter. The -k parameter instructs wireshark to start the capture session immediately.
wireshark -k -i /tmp/board &
Since this operation was going to execute for a long time, we sent it to the background to release the terminal for further use by placing the & symbol at the end of the command.
Finally, we started tcpdump over ssh on a board and redirected its output to our named pipe.
ssh root@10.7.6.5 "tcpdump -s 0 -U -n -w - -i lo not port 22" > /tmp/board;
The parameters we used on tcpdump have the following effects:
-s 0 instructs tcpdump to set the snapshot length of data from each packet to the default value of 262144 bytes.
-U Since the -w option is not specified, make the printed packet output packet-buffered. Which means that it will print the description of the contents of each packet without waiting for the output buffer to get full.
-n Does not convert host addresses to names. This can be used to avoid DNS lookups.
-w - Write the raw packets to Standard Output rather than parsing them.
-i lo Defines which interface to listen on. We wanted the loopback interface to listen to everything.
not port 22 Since we used ssh to start this command, we do not want to listen to the data that we produce as well and flood the inputs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment