1

I have 2 machine M1 and M2 running on Debian 8.0 located in 2 remote network N1 and N2

  • M1 is capturing packets continuousl in N1 and has a known static IP.

  • M2 is accessing the capture remotely from N2 by connecting to M1.

    What is the most common way of doing remote capture and implementing this system?

    The only solution I have now is to use a simple dumpcap pipe to openssl and then netcat:

  • On M1

      tshark -w - | openssl enc -des3 | nc -l 1234
    
  • On M2

       nc <M1 IP> 1234 | openssl enc -d -des3 > capture.pcap
    

I still cannot figure it out how to do it with ssh.

2 Answers 2

0

I usually use tcpdump to do packet captures:

 tcpdump -s0 -w </path/to/save/file>.pcap "<PCAP FILTER>"

where <PCAP_FILTER> is your query, such as host 192.168.86.1 to capture packets to/from 192.168.86.1. All the arguments for this can be found in a search, or look in the man pages obtained with man pcap-filter.

It will capture all of the packet, instead of just the headers with -s0. So don't use this argument for long-running captures, as the file will become large.

2
  • Thanks for your answer. However, how secured is pcap transmission. I would highly prefer ssh or openvpn.
    – user123456
    Dec 11, 2016 at 15:28
  • It doesn't go over the wire, just collects what is coming into the host. If you ssh to a server, then run tcpdump, it will collect packets on the server and won't transmit them over your ssh connection.
    – Kyle H
    Dec 11, 2016 at 15:55
0

Assume tcpdump is installed on M1, you are able to ssh to say user at M1 and user is allowed for sudoin M1. Then you could do

ssh user@M1 'sudo /usr/sbin/tcpdump "PCAP FILTER"'  
# will give you text output
ssh user@M1 'sudo /usr/sbin/tcpdump -w - "PCAP FILTER"' > /path/to/file.pcap  
# will save binary output to .pcap file

You should make your "PCAP FILTER" so that M2 is excluded from the dump; otherwise, the connection M2->M1 is recorded as well. You will be asked for user's password on M1, or you may authenticate by public key, depends on the ssh configuration of M1.

Or, using tshark as you asked for:

ssh user@M1 'sudo /path/to/tshark -R <filter> -w -' > capture.pcap

For 'filter', same holds as above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .