5

It is possible to setup an SSH port forward where the ssh client prints out the traffic exchanged over the ssh port to the screen or a file.

I am trying to debug a problem and want to see what is being sent between a java process running on my local machine and a remote process running on Solaris. I am using the port forwarding via ssh so that i can step through the java program. Normally I would have to copy the .java files to the Solaris machine, build them and run and it is not very productive way to debug, thus the port forwarding. The client and server as using IIOP protocol so I can't use an http proxy to monitor the traffic.

  • Might just be easier to use e.g., wireshark or tcpdump to listen to the traffic. You should be able to capture it on the host-local interface (lo on Linux, not sure what Solaris calls it) – derobert Aug 12 '13 at 17:22
7

I would cheat and put a couple of netcat's and a tee in the pipeline:

nc -k -l -p $localport -c "tee file.out | nc 127.0.0.1 $portforwardport"

where $localport is an arbitrary port to point your java process at and $portforwardport is your ssh port forward port number. The -k makes the listening netcat stay listening rather than exiting after the first time a client disconnects. The output will end up in file.out on your localhost.

  • nc (netcat) did not take the -c option but ncat did it for me. – nicolasochem Aug 4 at 0:52
3

As @derobert said in the comments your best bet is likely going to be with a tool such as wireshark. You'll want to target the traffic coming in and out of your Java process prior to getting into the ssh tunnel. Since the tunnel is encrypted you're not going to be able to peak inside it.

Also the sectools.org website maintains an extensive list of sniffing tools which you can check out if wireshark doesn't seem to fit your needs.

0

You may use tcpdump

$> sudo tcpdump -vv -x -X -s 1500 -i lo 'port 8000' 

This works if you have mapped the ssh tunnel to localhost (interface lo) to port 8000

-vv verbose level 2
-X  print data in hex and ASCII 
-x  print data in hex to a max limit of -s 
-s  snaplen - limit of data to print
-i eth0 tcpdump on the eth0 interface

You may allso save this script in your path as sniff-port

#!/bin/bash -xe
# use the first argument as port. if not defined default to 8080
PORT=${1:-8080} 
# sniff sniff
sudo tcpdump -vv -x -X -s 1500 "port $PORT" -i lo

and then use it as

$> sniff-port 1234
-2

You can use kismet https://kismetwireless.net/ for sniffing.

  • Kismet is for wireless sniffing – Anthon Dec 18 '13 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.