rshark

#!/bin/bash

set -o nounset
set -o errexit

iface=any

function show_usage() {
    echo "Usage: `basename $0` HOST EXPR"
    echo "Example: `basename $0` myarg"
}


while getopts "i:h" opt; do
    case "$opt" in
    i) iface="$OPTARG" ;;
    h) show_usage >&2; exit ;;
    esac
done

shift $((OPTIND-1))

if [ "$#" -ne 2 ]; then
    show_usage >&2; exit
fi

host="$1"
expr="$2"

wireshark -k -i <(ssh -l root $host "tcpdump -i $iface -s 0 -U -n -w - \"$expr\"")