I have a whole bunch of hosts at various WAN sites that are used for
remote captures. Right now, people log in to them remotely and kick
off tcpdump or wireshark on the host itself. I'd like to get away
from that. I'm willing to develop something myself, but prefer to not
reinvent the wheel. rpcap looks like a step in the right direction.
But it seems to be a streaming solution, which is bad over a WAN; it
doesn't seem to have a mechanism to centrally list many supported
devices; and it doesn't seem very cross-platform. Is rpcap more
capable than I am seeing? Is there a different (free) option?
Thanks.
- Morty
