1SSHDUMP(1)              The Wireshark Network Analyzer              SSHDUMP(1)
2
3
4

NAME

6       sshdump - Provide interfaces to capture from a remote host through SSH
7       using a remote capture binary.
8

SYNOPSIS

10       sshdump [ --help ] [ --version ] [ --extcap-interfaces ]
11       [ --extcap-dlts ] [ --extcap-interface=<interface> ]
12       [ --extcap-config ] [ --extcap-capture-filter=<capture filter> ]
13       [ --capture ] [ --fifo=<path to file or pipe> ]
14       [ --remote-host=<IP address> ] [ --remote-port=<TCP port> ]
15       [ --remote-username=<username> ] [ --remote-password=<password> ]
16       [ --sshkey=<public key path<gt ]> [ --remote-interface=<interface> ]
17       [ --remote-capture-command=<capture command> ] [ --remote-sudo ]
18
19       sshdump --extcap-interfaces
20
21       sshdump --extcap-interface=<interface> --extcap-dlts
22
23       sshdump --extcap-interface=<interface> --extcap-config
24
25       sshdump --extcap-interface=<interface> --fifo=<path to file or pipe>
26       --capture --remote-host=myremotehost --remote-port=22
27       --remote-username=user --remote-interface=eth2
28       --remote-capture-command='tcpdump -U -i eth0 -w-'
29

DESCRIPTION

31       Sshdump is an extcap tool that allows one to run a remote capture tool
32       over a SSH connection. The requirement is that the capture executable
33       must have the capabilities to capture from the wanted interface.
34
35       The feature is functionally equivalent to run commands like
36
37       $ ssh remoteuser@remotehost -p 22222 'tcpdump -U -i IFACE -w -' > FILE
38       & $ wireshark FILE
39
40       $ ssh remoteuser@remotehost '/sbin/dumpcap -i IFACE -P -w - -f "not
41       port 22"' > FILE & $ wireshark FILE
42
43       $ ssh somehost dumpcap -P -w - -f udp | tshark -i -
44
45       Supported interfaces:
46
47       1. ssh
48

OPTIONS

50       --help
51           Print program arguments.
52
53       --version
54           Print program version.
55
56       --extcap-interfaces
57           List available interfaces.
58
59       --extcap-interface=<interface>
60           Use specified interfaces.
61
62       --extcap-dlts
63           List DLTs of specified interface.
64
65       --extcap-config
66           List configuration options of specified interface.
67
68       --capture
69           Start capturing from specified interface and write raw packet data
70           to the location specified by --fifo.
71
72       --fifo=<path to file or pipe>
73           Save captured packet to file or send it through pipe.
74
75       --remote-host=<remote host>
76           The address of the remote host for capture.
77
78       --remote-port=<remote port>
79           The SSH port of the remote host.
80
81       --remote-username=<username>
82           The username for ssh authentication.
83
84       --remote-password=<password>
85           The password to use (if not ssh-agent and pubkey are used).
86           WARNING: the passwords are stored in plaintext and visible to all
87           users on this system. It is recommended to use keyfiles with a SSH
88           agent.
89
90       --sshkey=<SSH private key path>
91           The path to a private key for authentication.
92
93       --remote-interface=<remote interface>
94           The remote network interface to capture from.
95
96       --remote-capture-command=<capture command>
97           A custom remote capture command that produces the remote stream
98           that is shown in Wireshark.  The command must be able to produce a
99           PCAP stream written to STDOUT. See below for more examples.
100
101           When specified, this command will be used as is, no interface, port
102           or filter options will be added.
103
104       --extcap-capture-filter=<capture filter>
105           The capture filter
106

EXAMPLES

108       To see program arguments:
109
110           sshdump --help
111
112       To see program version:
113
114           sshdump --version
115
116       To see interfaces:
117
118           sshdump --extcap-interfaces
119
120       Only one interface (sshdump) is supported.
121
122         Output:
123           interface {value=sshdump}{display=SSH remote capture}
124
125       To see interface DLTs:
126
127           sshdump --extcap-interface=sshdump --extcap-dlts
128
129         Output:
130           dlt {number=147}{name=sshdump}{display=Remote capture dependent DLT}
131
132       To see interface configuration options:
133
134           sshdump --extcap-interface=sshdump --extcap-config
135
136         Output:
137
138           arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}
139               {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
140           arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}
141               {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
142           arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}
143               {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
144           arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}
145               {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
146           arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}
147               {tooltip=The path on the local filesystem of the private ssh key}{group=Authentication}
148           arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}
149               {tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
150           arg {number=6}{call=--proxycommand}{display=ProxyCommand}{type=string}
151               {tooltip=The command to use as proxy for the SSH connection}{group=Authentication}
152           arg {number=7}{call=--remote-interface}{display=Remote interface}{type=string}
153               {tooltip=The remote network interface used for capture}{group=Capture}
154           arg {number=8}{call=--remote-capture-command}{display=Remote capture command}{type=string}
155               {tooltip=The remote command used to capture}{group=Capture}
156           arg {number=9}{call=--remote-sudo}{display=Use sudo on the remote machine}{type=boolean}
157               {tooltip=Prepend the capture command with sudo on the remote machine}{group=Capture}
158           arg {number=10}{call=--remote-noprom}{display=No promiscuous mode}{type=boolflag}
159               {tooltip=Don't use promiscuous mode on the remote machine}{group=Capture}
160           arg {number=11}{call=--remote-filter}{display=Remote capture filter}{type=string}
161               {tooltip=The remote capture filter}{default=not ((host myhost) and port 22)}{group=Capture}
162           arg {number=12}{call=--remote-count}{display=Packets to capture}{type=unsigned}{default=0}
163               {tooltip=The number of remote packets to capture. (Default: inf)}{group=Capture}
164           arg {number=13}{call=--debug}{display=Run in debug mode}{type=boolflag}{default=false}
165               {tooltip=Print debug messages}{required=false}{group=Debug}
166           arg {number=14}{call=--debug-file}{display=Use a file for debug}{type=string}
167               {tooltip=Set a file where the debug messages are written}{required=false}{group=Debug}
168
169       To capture:
170
171           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
172           --remote-username user --remote-filter "not port 22"
173
174       To use different capture binaries:
175
176           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
177           --remote-capture-command='dumpcap -i eth0 -P -w -'
178
179           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
180           --remote-capture-command='sudo tcpdump -i eth0 -U -w -'
181
182       NOTE: To stop capturing CTRL+C/kill/terminate application.
183

SEE ALSO

185       wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1)
186

NOTES

188       Sshdump is part of the Wireshark distribution.  The latest version of
189       Wireshark can be found at <https://www.wireshark.org>.
190
191       HTML versions of the Wireshark project man pages are available at:
192       <https://www.wireshark.org/docs/man-pages>.
193

AUTHORS

195         Original Author
196         -------- ------
197         Dario Lombardo             <lomato[AT]gmail.com>
198
199
200
2013.0.5                             2019-10-30                        SSHDUMP(1)
Impressum