[CentOS] Capturing Packets -- Ethereal

Thu Jan 17 00:10:42 UTC 2008
Les Mikesell <lesmikesell at gmail.com>

Al Sparks wrote:
>>> From: Milton Calnek <milton at calnek.com>
>> To: CentOS mailing list <centos at centos.org>
>> Sent: Wednesday, January 16, 2008 12:50:47 PM
>> Subject: Re: [CentOS] Capturing Packets -- Ethereal
>>
>> The thing to do is to install wireshark on the system without X.
>>
>> Then from a machine with X:
>> ssh -Xf user at macine.without.x wireshark
> 
> Yours is the coolest answer, though the others were also helpful.

You can also 'ssh -Y user at machine', log in and 'wireshark &' to start 
it, which will open a new window on your desktop.  I think you also need 
to install wireshark-gnome for the GUI part.

When capturing, you'll probably want to do capture/options and add a 
capture filter like 'not host your_desktop' to ignore the traffic that 
the window is sending.

-- 
   Les Mikesell
    lesmikesell at gmail.com