Sometimes you want to run Wireshark on a remote connection, and it is relatively simple. This works on Mac and Linux, and probably other nux devices (BSD, Hurd etc).
Capturing Packets on a remote system is super useful, but you don't always want to run a desktop over there, especially if that computer is truly headless or a cloud computer. So this is an easy way that you can use SSH to capture the packets from that system, and send those packets to your desktop where you can do your analysis and filtering and glueing together to diagnose whatever problem or thing you want to do with it. To do this, I'm using wireshark, as well as tcpdump and ssh. It assumes you have both access to the remote system, and root or equivalent on it (because tcpdump needs to access the interfaces frames directly.
If you don't have this, or you have an inaccessible device, then this would work on a router or firewall, if that has ssh and tcpdump. However, this is not a method for spying on people, it's for diagnosing issues with a service or application to fix the underlying cause.
For steps also see: invalidentry.e...
Steps
Prepare the remote computer - on the remote computer, you need tcpdump installed. So with your favourite package manager, you want something like
sudo apt-get install tcpdump
On your desktop, make a named pipe:
mkfifo /tmp/paccap
Run wireshark from the terminal of your desktop
wireshark -k -i /tmp/paccap
Now connect the remote TCP dump to your fifo queue, so from your desktop:
ssh user@hostname "sudo tcpdump -s 0 -U -n -w - -i INTERFACENAME not port 22" GREATERTHANSIGN /tmp/paccap
I can't put Angled Brackets into the description, so please replace GREATERTHANSIGN with a greater than angled bracket (See the video or the link above)
This last line needs the interface name and the user/host replacing - e.g. its probably eth0 or wlan0 or similar - use ip a or ifconfig to get a list of your interfaces
Notes:
The user in the last step can be root, but only if root ssh logins are enabled in the remote's sshd. If not, you have to sudo (as per this command). To Sudo though, you need a no-password line in the sudoers, either globably or just for tcpdump. You probably can't run tcpdump as a user.
You want to keep the not port 22 as a safety in case you get the wrong interface. Because you're ssh'ing into port 22, and then sending all the packets back, it will then try to dump the fact you sent a packet back and get into a loop of creating more and more data.