Wireshark · Ethereal-dev: Re: [Ethereal-dev] Remote Sniffing

[Pierre JUHEN <pierre.juhen@xxxxxxxxxx>]

Here is my command to do that :
   ssh 'root@remote' -C "tethereal -i eth0 -l -w -" | ethereal -i "-" 
-k -l -S

1/ It does work real time, at least with recent version

2/ another option : use tcpdump and netcat/nc.  This should use a very 
small memory footprint.

Something like that
   on the remote device :

         tcpdump -i eth0 -l -S -w | nc local 23450

   on the local device

         nc -l -p 23450 | ethereal -i "-" -k -l -S

Be careful not to sniff the pcap stream, it could lead though some 
network looping...

You could use udp with the "-u" option of nc.