0

I want to capture packets from a remote server using Wireshark. I have a Linux-based server and I can access to it through Putty. This remote server is not on my network. How could I access to a remote server packets and especially MQTT protocol from my home using Wireshark?

I used a remote SSH configuration, but it seems I can't capture the data.

screenshot of wireshark

Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
Istabraq Mahmood
  • 11
  • 1

2 Answers2

4

You can run wireshark on remote server (e.g. via ssh) and transfer results back to your machine for convenience.

E.g. this article has an example: ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i - - I'll run capture on remote machine, pipe results to local wireshark where you'd be able to see results in nice GUI.

rvs
  • 4,125
  • 1
  • 27
  • 31
0

Similar to @rvs answer:

ssh myuser@remote-server.example.com sudo tcpdump --dont-verify-checksums -i any -U -s0 -w - 'port 1883 and src 192.168.0.22' | wireshark -k -i -

Differences:

  • make use of sudo
  • use tcpdump instead of tshark

Please mind: you've to install tcpdump on your "server".

It is possible to capture the loopback interface in the remote server in the same way?

Yes, see the parameter -i any ? --> any interface

ppuschmann
  • 610
  • 1
  • 6
  • 16