I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH to my local machine (Ubuntu) which has Wireshark installed.
I cannot login to the server with a root account because that is disabled. I have sudo rights, but when logged in to the server the command
sudo tcpdump does not work. The command below (with or without sudo) won't work:
$ ssh firstname.lastname@example.org "sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote
Is there a way to get this working? If so - how?