1SSHDUMP(1) SSHDUMP(1)
2
6 sshdump - Provide interfaces to capture from a remote host through SSH
7 using a remote capture binary.
8
10 sshdump [ --help ] [ --version ] [ --extcap-interfaces ]
11 [ --extcap-dlts ] [ --extcap-interface=<interface> ]
12 [ --extcap-config ] [ --extcap-capture-filter=<capture filter> ]
13 [ --capture ] [ --fifo=<path to file or pipe> ]
14 [ --remote-host=<IP address> ] [ --remote-port=<TCP port> ]
15 [ --remote-username=<username> ] [ --remote-password=<password> ]
16 [ --sshkey=<public key path> ] [ --remote-interface=<interface> ]
17 [ --remote-capture-command-select=<capture command selection> ]
18 [ --remote-capture-command=<capture command> ] [ --remote-sudo ]
19 sshdump --extcap-interfaces
21 sshdump --extcap-interface=<interface> --extcap-dlts
23 sshdump --extcap-interface=<interface> --extcap-config
25 sshdump --extcap-interface=<interface> --fifo=<path to file or pipe>
27 --capture --remote-host=myremotehost --remote-port=22
28 --remote-username=user --remote-interface=eth2
29 --remote-capture-command='tcpdump -U -i eth0 -w-'
30
32 Sshdump is an extcap tool that allows one to run a remote capture tool
33 over a SSH connection. The requirement is that the capture executable
34 must have the capabilities to capture from the wanted interface.
35 The feature is functionally equivalent to run commands like
37 $ ssh remoteuser@remotehost -p 22222 'tcpdump -U -i IFACE -w -' > FILE &
39 $ wireshark FILE
40 $ ssh remoteuser@remotehost '/sbin/dumpcap -i IFACE -P -w - -f "not port 22"' > FILE &
42 $ wireshark FILE
43 $ ssh somehost dumpcap -P -w - -f udp | tshark -i -
45 Typically sshdump is not invoked directly. Instead it can be configured
47 through the Wireshark graphical user interface or its command line. The
48 following will start Wireshark and start capturing from host
49 remotehost:
50 $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' -i sshdump -k
52 To explicitly control the remote capture command:
54 $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' \
56 '-oextcap.sshdump.remotecapturecommand:"tcpdump -i eth0 -Uw- not port 22"' \
57 -i sshdump -k
58 Supported interfaces:
60 1. ssh
62
64 --help
65 Print program arguments.
67 --version
69 Print program version.
71 --extcap-interfaces
73 List available interfaces.
75 --extcap-interface=<interface>
77 Use specified interfaces.
79 --extcap-dlts
81 List DLTs of specified interface.
83 --extcap-config
85 List configuration options of specified interface.
87 --capture
89 Start capturing from specified interface and write raw packet data
91 to the location specified by --fifo.
92 --fifo=<path to file or pipe>
94 Save captured packet to file or send it through pipe.
96 --remote-host=<remote host>
98 The address of the remote host for capture.
100 --remote-port=<remote port>
102 The SSH port of the remote host.
104 --remote-username=<username>
106 The username for SSH authentication.
108 --remote-password=<password>
110 The password to use (if not ssh-agent and pubkey are used).
112 WARNING: the passwords are stored in plaintext and visible to all
113 users on this system. It is recommended to use keyfiles with a SSH
114 agent.
115 --sshkey=<SSH private key path>
117 The path to a private key for authentication. NOTE: Only OPENSSH
119 key/value pair format is supported.
120 --remote-interface=<remote interface>
122 The remote network interface to capture from.
124 --remote-capture-command-select=<capture command-selection>
126 The selection of the build-in support for remote capture commands.
128 Either dumpcap for a remote capture command using dumpcap, tcpdump
129 for a remote capture command using tcpdump, or other, where the
130 remote capture command is to be given with the
131 --remote-capture-command option.
132 Note that selecting dumpcap allows for specifying multiple capture
134 interfaces as a whitespace seperated list, while tcpdump does not.
135 --remote-capture-command=<capture command>
137 A custom remote capture command that produces the remote stream
139 that is shown in Wireshark. The command must be able to produce a
140 PCAP stream written to STDOUT. See below for more examples.
141 If using tcpdump, use the -w- option to ensure that packets are
143 written to standard output (stdout). Include the -U option to write
144 packets as soon as they are received.
145 When specified, this command will be used as is, options such as
147 the capture filter (--extcap-capture-filter) will not be appended.
148 --extcap-capture-filter=<capture filter>
150 The capture filter. It corresponds to the value provided via the
152 tshark -f option, and the Capture Filter field next to the
153 interfaces list in the Wireshark interface.
154
156 To see program arguments:
157 sshdump --help
159 To see program version:
161 sshdump --version
163 To see interfaces:
165 sshdump --extcap-interfaces
167 Only one interface (sshdump) is supported.
169 Example output
171 interface {value=sshdump}{display=SSH remote capture}
173 To see interface DLTs:
175 sshdump --extcap-interface=sshdump --extcap-dlts
177 Example output
179 dlt {number=147}{name=sshdump}{display=Remote capture dependent DLT}
181 To see interface configuration options:
183 sshdump --extcap-interface=sshdump --extcap-config
185 Example output
187 arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}
189 {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
190 arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}
191 {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
192 arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}
193 {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
194 arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}
195 {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
196 arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}
197 {tooltip=The path on the local filesystem of the private SSH key (OpenSSH format)}{mustexist=true}{group=Authentication}
198 arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}
199 {tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
200 arg {number=6}{call=--proxycommand}{display=ProxyCommand}{type=string}
201 {tooltip=The command to use as proxy for the SSH connection}{group=Authentication}
202 arg {number=7}{call=--remote-interface}{display=Remote interface}{type=string}
203 {tooltip=The remote network interface used for capture}{group=Capture}
204 arg {number=8}{call=--remote-capture-command-select}{display=Remote capture command selection}{type=radio}
205 {tooltip=The remote capture command to build a command line for}{group=Capture}
206 value {arg=8}{value=dumpcap}{display=dumpcap}
207 value {arg=8}{value=tcpdump}{display=tcpdump}{default=true}
208 value {arg=8}{value=other}{display=Other:}
209 arg {number=9}{call=--remote-capture-command}{display=Remote capture command}{type=string}
210 {tooltip=The remote command used to capture}{group=Capture}
211 arg {number=10}{call=--remote-sudo}{display=Use sudo on the remote machine}{type=boolflag}
212 {tooltip=Prepend the capture command with sudo on the remote machine}{group=Capture}
213 arg {number=11}{call=--remote-noprom}{display=No promiscuous mode}{type=boolflag}
214 {tooltip=Don't use promiscuous mode on the remote machine}{group=Capture}
215 arg {number=12}{call=--remote-filter}{display=Remote capture filter}{type=string}
216 {tooltip=The remote capture filter}{default=not ((host myhost) and port 22)}{group=Capture}
217 arg {number=13}{call=--remote-count}{display=Packets to capture}{type=unsigned}{default=0}
218 {tooltip=The number of remote packets to capture. (Default: inf)}{group=Capture}
219 arg {number=14}{call=--log-level}{display=Set the log level}{type=selector}
220 {tooltip=Set the log level}{required=false}{group=Debug}
221 value {arg=14}{value=message}{display=Message}{default=true}
222 value {arg=14}{value=info}{display=Info}
223 value {arg=14}{value=debug}{display=Debug}
224 value {arg=14}{value=noisy}{display=Noisy}
225 arg {number=15}{call=--log-file}{display=Use a file for logging}{type=fileselect}
226 {tooltip=Set a file where log messages are written}{required=false}{group=Debug}
227 To capture:
229 sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
231 --remote-username user --remote-filter "not port 22"
232 To use different capture binaries:
234 sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
236 --remote-capture-command='dumpcap -i eth0 -P -w -'
237 sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
239 --remote-capture-command='sudo tcpdump -i eth0 -U -w -'
240 Note
242 To stop capturing CTRL+C/kill/terminate the application.
243 The sshdump binary can be renamed to support multiple instances. For
245 instance if we want sshdump to show up twice in wireshark (for instance
246 to handle multiple profiles), we can copy sshdump to sshdump-host1 and
247 sshdump-host2. Each binary will show up an interface name same as the
248 executable name. Those executables not being "sshdump" will show up as
249 "custom version" in the interface description.
250
252 wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1)
253
255 Sshdump is part of the Wireshark distribution. The latest version of
256 Wireshark can be found at https://www.wireshark.org.
257 HTML versions of the Wireshark project man pages are available at
259 https://www.wireshark.org/docs/man-pages.
260
262 Original Author
263 Dario Lombardo <lomato[AT]gmail.com>
264 2023-08-31 SSHDUMP(1)