The situation

I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH to my local machine (Ubuntu) which has Wireshark installed.

The problem

I cannot login to the server with a root account because that is disabled. I have sudo rights, but when logged in to the server the command sudo tcpdump does not work. The command below (with or without sudo) won't work:

$ ssh john@server-abc.com "sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote

The question

Is there a way to get this working? If so - how?

  • 1
    Do you need to pipe data ? Can you run the tcpdump for as long as you need, and then use wireshark later to review the data ? – Lawrence Jul 17 '14 at 13:23
  • That is an option I didn't consider yet! – SPRBRN Jul 17 '14 at 13:24
  • 2
    By "does not work", does that mean you get an error message? – Mark Plotnick Jul 17 '14 at 14:23
  • I guess tcpdump is not in the allowed commands for sudo, and this seems to be the case for some servers, not all. So on some I can use sudo. – SPRBRN Jul 17 '14 at 15:38

You can run this command via sudo on the server to capture the data first, and then send the resulting file back to your workstation to review the data

sudo tcpdump -i eth0 -s 65535 -w /tmp/wireshark

Without sudo the command doesn't have privileges to capture the device:

tcpdump: eth0: You don't have permission to capture on that device

But with sudo it would, but being run after ssh, it never gets password input for sudo on the remote server, so the solution is use -S (man sudo) and pipe password for sudo as follows:

ssh john@server-abc.com "echo sudo_password | sudo -S tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote"

On the one hand this is good for the automation with no getting sudo password promts and, to have completely automated code/script you would add sshpass -p password ssh....

However on the server where others can easily read your sudo password provided as open text during the ssh session that's not recommended from the security perspectives. So, to have a sudo with ssh and be safe use ssh -t

With -t it's impossible to pipe ssh "sudo command"| command for examplessh -t server "cd path/to/directory && sudo"|grep "text" but it IS possible with ussage of -S and echoing password, e.g. ssh server 'echo password | sudo -S ls -l'| grep 'a'

  • Perhaps you could expand this a bit and explain your answer a bit? – slm Jul 23 '14 at 14:16
  • 1
    @sim I added an explanation. – Ruslan Gerasimov Jul 23 '14 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.