Capture, save and open a tcpdump with Wireshark over ssh

Do you need live access to the network capture, but Wireshark is not installed on the target system? Or you haven’t enough space to store the capture on the target system? Then this blog post will help you! I’ll show you how to capture traces with tcpdump on a server and open them directly in Wireshark on a client with ssh. The capture is not saved on the server but optional on the client site.

Syncronice Wireshark settings with git

With my new role as SRE, I started to use Wireshark more often and distributed across systems with different OS. Further, we as a team want to benefit from each other’s knowledge and Wireshark settings. These settings include profiles where you can configure color filters, predefined display filters, displayed columns, io graphs and so on. The target is an easy synchronization of the relevant settings. Parameters related to my systems, like Windows size or last opened files, should be excluded. In the title, I already anticipate the solution: git! But let’s start from scratch. At my Github daniel8192/Wireshark you will also find an example with 2 profiles for TCP analysis and for the analysis of TCP delta times.