4

The situation

I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH to my local machine (Ubuntu) which has Wireshark installed.

The problem

I cannot login to the server with a root account because that is disabled. I have sudo rights, but when logged in to the server the command sudo tcpdump does not work. The command below (with or without sudo) won't work:

$ ssh [email protected] "sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote

The question

Is there a way to get this working? If so - how?

4
  • 1
    Do you need to pipe data ? Can you run the tcpdump for as long as you need, and then use wireshark later to review the data ?
    – Lawrence
    Jul 17, 2014 at 13:23
  • That is an option I didn't consider yet!
    – SPRBRN
    Jul 17, 2014 at 13:24
  • 2
    By "does not work", does that mean you get an error message? Jul 17, 2014 at 14:23
  • I guess tcpdump is not in the allowed commands for sudo, and this seems to be the case for some servers, not all. So on some I can use sudo.
    – SPRBRN
    Jul 17, 2014 at 15:38

2 Answers 2

4

Without sudo the command doesn't have privileges to capture the device:

tcpdump: eth0: You don't have permission to capture on that device

But with sudo it would, but being run after ssh, it never gets password input for sudo on the remote server, so the solution is use -S (man sudo) and pipe password for sudo as follows:

ssh [email protected] "echo sudo_password | sudo -S tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote"

On the one hand this is good for the automation with no getting sudo password promts and, to have completely automated code/script you would add sshpass -p password ssh....

However on the server where others can easily read your sudo password provided as open text during the ssh session that's not recommended from the security perspectives. So, to have a sudo with ssh and be safe use ssh -t

With -t it's impossible to pipe ssh "sudo command"| command for examplessh -t server "cd path/to/directory && sudo"|grep "text" but it IS possible with ussage of -S and echoing password, e.g. ssh server 'echo password | sudo -S ls -l'| grep 'a'

2
  • Perhaps you could expand this a bit and explain your answer a bit?
    – slm
    Jul 23, 2014 at 14:16
  • 1
    @sim I added an explanation. Jul 23, 2014 at 23:45
3

You can run this command via sudo on the server to capture the data first, and then send the resulting file back to your workstation to review the data

sudo tcpdump -i eth0 -s 65535 -w /tmp/wireshark

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .