1SSHDUMP(1)                                                          SSHDUMP(1)
2
3
4

NAME

6       sshdump - Provide interfaces to capture from a remote host through SSH
7       using a remote capture binary.
8

SYNOPSIS

10       sshdump [ --help ] [ --version ] [ --extcap-interfaces ]
11       [ --extcap-dlts ] [ --extcap-interface=<interface> ]
12       [ --extcap-config ] [ --extcap-capture-filter=<capture filter> ]
13       [ --capture ] [ --fifo=<path to file or pipe> ]
14       [ --remote-host=<IP address> ] [ --remote-port=<TCP port> ]
15       [ --remote-username=<username> ] [ --remote-password=<password> ]
16       [ --sshkey=<public key path> ] [ --remote-interface=<interface> ]
17       [ --remote-capture-command-select=<capture command selection> ]
18       [ --remote-capture-command=<capture command> ] [ --remote-sudo ]
19
20       sshdump --extcap-interfaces
21
22       sshdump --extcap-interface=<interface> --extcap-dlts
23
24       sshdump --extcap-interface=<interface> --extcap-config
25
26       sshdump --extcap-interface=<interface> --fifo=<path to file or pipe>
27       --capture --remote-host=myremotehost --remote-port=22
28       --remote-username=user --remote-interface=eth2
29       --remote-capture-command='tcpdump -U -i eth0 -w-'
30

DESCRIPTION

32       Sshdump is an extcap tool that allows one to run a remote capture tool
33       over a SSH connection. The requirement is that the capture executable
34       must have the capabilities to capture from the wanted interface.
35
36       The feature is functionally equivalent to run commands like
37
38           $ ssh remoteuser@remotehost -p 22222 'tcpdump -U -i IFACE -w -' > FILE &
39           $ wireshark FILE
40
41           $ ssh remoteuser@remotehost '/sbin/dumpcap -i IFACE -P -w - -f "not port 22"' > FILE &
42           $ wireshark FILE
43
44           $ ssh somehost dumpcap -P -w - -f udp | tshark -i -
45
46       Typically sshdump is not invoked directly. Instead it can be configured
47       through the Wireshark graphical user interface or its command line. The
48       following will start Wireshark and start capturing from host
49       remotehost:
50
51           $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' -i sshdump -k
52
53       To explicitly control the remote capture command:
54
55           $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' \
56                       '-oextcap.sshdump.remotecapturecommand:"tcpdump -i eth0 -Uw- not port 22"' \
57                       -i sshdump -k
58
59       Supported interfaces:
60
61        1. ssh
62

OPTIONS

64       --help
65
66           Print program arguments.
67
68       --version
69
70           Print program version.
71
72       --extcap-interfaces
73
74           List available interfaces.
75
76       --extcap-interface=<interface>
77
78           Use specified interfaces.
79
80       --extcap-dlts
81
82           List DLTs of specified interface.
83
84       --extcap-config
85
86           List configuration options of specified interface.
87
88       --capture
89
90           Start capturing from specified interface and write raw packet data
91           to the location specified by --fifo.
92
93       --fifo=<path to file or pipe>
94
95           Save captured packet to file or send it through pipe.
96
97       --remote-host=<remote host>
98
99           The address of the remote host for capture.
100
101       --remote-port=<remote port>
102
103           The SSH port of the remote host.
104
105       --remote-username=<username>
106
107           The username for SSH authentication.
108
109       --remote-password=<password>
110
111           The password to use (if not ssh-agent and pubkey are used).
112           WARNING: the passwords are stored in plaintext and visible to all
113           users on this system. It is recommended to use keyfiles with a SSH
114           agent.
115
116       --sshkey=<SSH private key path>
117
118           The path to a private key for authentication. NOTE: Only OPENSSH
119           key/value pair format is supported.
120
121       --remote-interface=<remote interface>
122
123           The remote network interface to capture from.
124
125       --remote-capture-command-select=<capture command-selection>
126
127           The selection of the build-in support for remote capture commands.
128           Either dumpcap for a remote capture command using dumpcap, tcpdump
129           for a remote capture command using tcpdump, or other, where the
130           remote capture command is to be given with the
131           --remote-capture-command option.
132
133           Note that selecting dumpcap allows for specifying multiple capture
134           interfaces as a whitespace seperated list, while tcpdump does not.
135
136       --remote-capture-command=<capture command>
137
138           A custom remote capture command that produces the remote stream
139           that is shown in Wireshark. The command must be able to produce a
140           PCAP stream written to STDOUT. See below for more examples.
141
142           If using tcpdump, use the -w- option to ensure that packets are
143           written to standard output (stdout). Include the -U option to write
144           packets as soon as they are received.
145
146           When specified, this command will be used as is, options such as
147           the capture filter (--extcap-capture-filter) will not be appended.
148
149       --extcap-capture-filter=<capture filter>
150
151           The capture filter. It corresponds to the value provided via the
152           tshark -f option, and the Capture Filter field next to the
153           interfaces list in the Wireshark interface.
154

EXAMPLES

156       To see program arguments:
157
158           sshdump --help
159
160       To see program version:
161
162           sshdump --version
163
164       To see interfaces:
165
166           sshdump --extcap-interfaces
167
168       Only one interface (sshdump) is supported.
169
170       Example output
171
172           interface {value=sshdump}{display=SSH remote capture}
173
174       To see interface DLTs:
175
176           sshdump --extcap-interface=sshdump --extcap-dlts
177
178       Example output
179
180           dlt {number=147}{name=sshdump}{display=Remote capture dependent DLT}
181
182       To see interface configuration options:
183
184           sshdump --extcap-interface=sshdump --extcap-config
185
186       Example output
187
188           arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}
189               {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
190           arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}
191               {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
192           arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}
193               {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
194           arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}
195               {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
196           arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}
197               {tooltip=The path on the local filesystem of the private SSH key (OpenSSH format)}{mustexist=true}{group=Authentication}
198           arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}
199               {tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
200           arg {number=6}{call=--proxycommand}{display=ProxyCommand}{type=string}
201               {tooltip=The command to use as proxy for the SSH connection}{group=Authentication}
202           arg {number=7}{call=--remote-interface}{display=Remote interface}{type=string}
203               {tooltip=The remote network interface used for capture}{group=Capture}
204           arg {number=8}{call=--remote-capture-command-select}{display=Remote capture command selection}{type=radio}
205               {tooltip=The remote capture command to build a command line for}{group=Capture}
206               value {arg=8}{value=dumpcap}{display=dumpcap}
207               value {arg=8}{value=tcpdump}{display=tcpdump}{default=true}
208               value {arg=8}{value=other}{display=Other:}
209           arg {number=9}{call=--remote-capture-command}{display=Remote capture command}{type=string}
210               {tooltip=The remote command used to capture}{group=Capture}
211           arg {number=10}{call=--remote-sudo}{display=Use sudo on the remote machine}{type=boolflag}
212               {tooltip=Prepend the capture command with sudo on the remote machine}{group=Capture}
213           arg {number=11}{call=--remote-noprom}{display=No promiscuous mode}{type=boolflag}
214               {tooltip=Don't use promiscuous mode on the remote machine}{group=Capture}
215           arg {number=12}{call=--remote-filter}{display=Remote capture filter}{type=string}
216               {tooltip=The remote capture filter}{default=not ((host myhost) and port 22)}{group=Capture}
217           arg {number=13}{call=--remote-count}{display=Packets to capture}{type=unsigned}{default=0}
218               {tooltip=The number of remote packets to capture. (Default: inf)}{group=Capture}
219           arg {number=14}{call=--log-level}{display=Set the log level}{type=selector}
220               {tooltip=Set the log level}{required=false}{group=Debug}
221               value {arg=14}{value=message}{display=Message}{default=true}
222               value {arg=14}{value=info}{display=Info}
223               value {arg=14}{value=debug}{display=Debug}
224               value {arg=14}{value=noisy}{display=Noisy}
225           arg {number=15}{call=--log-file}{display=Use a file for logging}{type=fileselect}
226               {tooltip=Set a file where log messages are written}{required=false}{group=Debug}
227
228       To capture:
229
230           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
231           --remote-username user --remote-filter "not port 22"
232
233       To use different capture binaries:
234
235           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
236           --remote-capture-command='dumpcap -i eth0 -P -w -'
237
238           sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
239           --remote-capture-command='sudo tcpdump -i eth0 -U -w -'
240
241           Note
242           To stop capturing CTRL+C/kill/terminate the application.
243
244       The sshdump binary can be renamed to support multiple instances. For
245       instance if we want sshdump to show up twice in wireshark (for instance
246       to handle multiple profiles), we can copy sshdump to sshdump-host1 and
247       sshdump-host2. Each binary will show up an interface name same as the
248       executable name. Those executables not being "sshdump" will show up as
249       "custom version" in the interface description.
250

SEE ALSO

252       wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1)
253

NOTES

255       Sshdump is part of the Wireshark distribution. The latest version of
256       Wireshark can be found at https://www.wireshark.org.
257
258       HTML versions of the Wireshark project man pages are available at
259       https://www.wireshark.org/docs/man-pages.
260

AUTHORS

262       Original Author
263       Dario Lombardo <lomato[AT]gmail.com>
264
265
266
267                                  2023-08-31                        SSHDUMP(1)
Impressum