We just use ssh to pipe the captured traffic through to the local Wireshark.

But using the Wireshark for the same query gives you better results. Sure, it’s quite easy to sniffer on a remote Linux box with tcpdump into an file and copy that over via scp to the local system and take a closer look at the traffic. You want to check the TTL/hop count of BGP packets before activating TTL security You want to look at encrypted SNMPv3 packets (Wireshark is able to decrypt it, if provided the password) You want to look at DHCP packets and their content Sometimes a tcpdump is not enough to give you correct information and when you want additional information like : Why would you want to sniff at live network flow?. In this tutorial, we will learn how to live sniffer network traffic using Wireshark thanks to Robert Penz. Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2. Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform).

You can also export to XML, PostScript®, CSV, or plain text. Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, WildPackets EtherPeek/TokenPeek/AiroPeek … it’s a long list. Captured network data can be browsed via a GUI or via the TTY-mode TShark utility.

Live capture and offline analysis with powerful display filters. Deep inspection of hundreds of protocols, with more being added all the time.

Wireshark usb sniffer