.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.if !\nF .nr F 0
.if \nF>0 \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    if !\nF==2 \{\
.        nr % 0
.        nr F 2
.    \}
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "SSHDUMP 1"
.TH SSHDUMP 1 "2019-03-23" "2.6.7" "The Wireshark Network Analyzer"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
sshdump \- Provide interfaces to capture from a remote host through SSH using a remote capture binary.
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
\&\fBsshdump\fR
[\ \fB\-\-help\fR\ ]
[\ \fB\-\-version\fR\ ]
[\ \fB\-\-extcap\-interfaces\fR\ ]
[\ \fB\-\-extcap\-dlts\fR\ ]
[\ \fB\-\-extcap\-interface\fR=<interface>\ ]
[\ \fB\-\-extcap\-config\fR\ ]
[\ \fB\-\-extcap\-capture\-filter\fR=<capture\ filter>\ ]
[\ \fB\-\-capture\fR\ ]
[\ \fB\-\-fifo\fR=<path\ to\ file\ or\ pipe>\ ]
[\ \fB\-\-remote\-host\fR=<\s-1IP\s0\ address>\ ]
[\ \fB\-\-remote\-port\fR=<\s-1TCP\s0\ port>\ ]
[\ \fB\-\-remote\-username\fR=<username>\ ]
[\ \fB\-\-remote\-password\fR=<password>\ ]
[\ \fB\-\-sshkey\fR=<public\ key\ path<gt ]>
[\ \fB\-\-remote\-interface\fR=<interface>\ ]
[\ \fB\-\-remote\-capture\-command\fR=<capture\ command>\ ]
.PP
\&\fBsshdump\fR
\&\fB\-\-extcap\-interfaces\fR
.PP
\&\fBsshdump\fR
\&\fB\-\-extcap\-interface\fR=<interface>
\&\fB\-\-extcap\-dlts\fR
.PP
\&\fBsshdump\fR
\&\fB\-\-extcap\-interface\fR=<interface>
\&\fB\-\-extcap\-config\fR
.PP
\&\fBsshdump\fR
\&\fB\-\-extcap\-interface\fR=<interface>
\&\fB\-\-fifo\fR=<path\ to\ file\ or\ pipe>
\&\fB\-\-capture\fR
\&\fB\-\-remote\-host=myremotehost\fR
\&\fB\-\-remote\-port=22\fR
\&\fB\-\-remote\-username=user\fR
\&\fB\-\-remote\-interface=eth2\fR
\&\fB\-\-remote\-capture\-command='tcpdump\ \-U\ \-i\ eth0\ \-w\-'\fR
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBSshdump\fR is a extcap tool that allows one to run a remote capture
tool in a \s-1SSH\s0 connection. The requirement is that the capture
executable must have the capabilities to capture from the wanted
interface.
.PP
The feature is functionally equivalent to run commands like
.PP
$ ssh remoteuser@remotehost \-p 22222 'tcpdump \-U \-i \s-1IFACE\s0 \-w \-' > \s-1FILE &
$\s0 wireshark \s-1FILE\s0
.PP
$ ssh remoteuser@remotehost '/sbin/dumpcap \-i \s-1IFACE \-P\s0 \-w \- \-f \*(L"not port 22\*(R"' > \s-1FILE &
$\s0 wireshark \s-1FILE\s0
.PP
Supported interfaces:
.IP "1. ssh" 4
.IX Item "1. ssh"
.SH "OPTIONS"
.IX Header "OPTIONS"
.PD 0
.IP "\-\-help" 4
.IX Item "--help"
.PD
Print program arguments.
.IP "\-\-version" 4
.IX Item "--version"
Print program version.
.IP "\-\-extcap\-interfaces" 4
.IX Item "--extcap-interfaces"
List available interfaces.
.IP "\-\-extcap\-interface=<interface>" 4
.IX Item "--extcap-interface=<interface>"
Use specified interfaces.
.IP "\-\-extcap\-dlts" 4
.IX Item "--extcap-dlts"
List DLTs of specified interface.
.IP "\-\-extcap\-config" 4
.IX Item "--extcap-config"
List configuration options of specified interface.
.IP "\-\-capture" 4
.IX Item "--capture"
Start capturing from specified interface and write raw packet data to the location specified by \-\-fifo.
.IP "\-\-fifo=<path to file or pipe>" 4
.IX Item "--fifo=<path to file or pipe>"
Save captured packet to file or send it through pipe.
.IP "\-\-remote\-host=<remote host>" 4
.IX Item "--remote-host=<remote host>"
The address of the remote host for capture.
.IP "\-\-remote\-port=<remote port>" 4
.IX Item "--remote-port=<remote port>"
The \s-1SSH\s0 port of the remote host.
.IP "\-\-remote\-username=<username>" 4
.IX Item "--remote-username=<username>"
The username for ssh authentication.
.IP "\-\-remote\-password=<password>" 4
.IX Item "--remote-password=<password>"
The password to use (if not ssh-agent and pubkey are used). \s-1WARNING:\s0 the
passwords are stored in plaintext and visible to all users on this system. It is
recommended to use keyfiles with a \s-1SSH\s0 agent.
.IP "\-\-sshkey=<\s-1SSH\s0 private key path>" 4
.IX Item "--sshkey=<SSH private key path>"
The path to a private key for authentication.
.IP "\-\-remote\-interface=<remote interface>" 4
.IX Item "--remote-interface=<remote interface>"
The remote network interface to capture from.
.IP "\-\-remote\-capture\-command=<capture command>" 4
.IX Item "--remote-capture-command=<capture command>"
A custom remote capture command that produces the remote stream that is shown in Wireshark.
The command must be able to produce a \s-1PCAP\s0 stream written to \s-1STDOUT.\s0 See below for more
examples.
.IP "\-\-extcap\-capture\-filter=<capture filter>" 4
.IX Item "--extcap-capture-filter=<capture filter>"
The capture filter
.SH "EXAMPLES"
.IX Header "EXAMPLES"
To see program arguments:
.PP
.Vb 1
\&    sshdump \-\-help
.Ve
.PP
To see program version:
.PP
.Vb 1
\&    sshdump \-\-version
.Ve
.PP
To see interfaces:
.PP
.Vb 1
\&    sshdump \-\-extcap\-interfaces
.Ve
.PP
Only one interface (ssh) is supported.
.PP
.Vb 2
\&  Output:
\&    interface {value=ssh}{display=SSH remote capture}
.Ve
.PP
To see interface DLTs:
.PP
.Vb 1
\&    sshdump \-\-extcap\-interface=ssh \-\-extcap\-dlts
\&
\&  Output:
\&    dlt {number=147}{name=ssh}{display=Remote capture dependent DLT}
.Ve
.PP
To see interface configuration options:
.PP
.Vb 1
\&    sshdump \-\-extcap\-interface=ssh \-\-extcap\-config
\&
\&  Output:
\&
\&    arg {number=0}{call=\-\-remote\-host}{display=Remote SSH server address}{type=string}
\&        {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}
\&    arg {number=1}{call=\-\-remote\-port}{display=Remote SSH server port}{type=unsigned}
\&        {default=22}{tooltip=The remote SSH host port (1\-65535)}{range=1,65535}
\&    arg {number=2}{call=\-\-remote\-username}{display=Remote SSH server username}{type=string}
\&        {default=myusername}{tooltip=The remote SSH username. If not provided, the current user will be used}
\&    arg {number=3}{call=\-\-remote\-password}{display=Remote SSH server password}{type=password}
\&        {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}
\&    arg {number=4}{call=\-\-sshkey}{display=Path to SSH private key}{type=fileselect}
\&        {tooltip=The path on the local filesystem of the private ssh key}
\&    arg {number=5}{call=\-\-sshkey\-passphrase}{display=SSH key passphrase}
\&        {type=string}{tooltip=Passphrase to unlock the SSH private key}
\&    arg {number=6}{call=\-\-remote\-interface}{display=Remote interface}{type=string}{default=eth0}
\&        {tooltip=The remote network interface used for capture}
\&    arg {number=7}{call=\-\-remote\-capture\-command}{display=Remote capture command}{type=string}
\&        {tooltip=The remote command used to capture.}
\&    arg {number=8}{call=\-\-remote\-filter}{display=Remote capture filter}{type=string}
\&        {default=not ((host myip) and port 22)}{tooltip=The remote capture filter}
\&    arg {number=9}{call=\-\-remote\-count}{display=Packets to capture}{type=unsigned}{default=0}
\&        {tooltip=The number of remote packets to capture. (Default: unlimited)}
.Ve
.PP
To capture:
.PP
.Vb 2
\&    sshdump \-\-extcap\-interface=ssh \-\-fifo=/tmp/ssh.pcap \-\-capture \-\-remote\-host 192.168.1.10
\&    \-\-remote\-username user \-\-remote\-filter "not port 22"
.Ve
.PP
To use different capture binaries:
.PP
.Vb 2
\&    sshdump \-\-extcap\-interface=ssh \-\-fifo=/tmp/ssh.pcap \-\-capture \-\-remote\-host 192.168.1.10
\&    \-\-remote\-capture\-command=\*(Aqdumpcap \-i eth0 \-P \-w \-\*(Aq
\&
\&    sshdump \-\-extcap\-interface=ssh \-\-fifo=/tmp/ssh.pcap \-\-capture \-\-remote\-host 192.168.1.10
\&    \-\-remote\-capture\-command=\*(Aqsudo tcpdump \-i eth0 \-U \-w \-\*(Aq
.Ve
.PP
\&\s-1NOTE:\s0 To stop capturing CTRL+C/kill/terminate application.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIwireshark\fR\|(1), \fItshark\fR\|(1), \fIdumpcap\fR\|(1), \fIextcap\fR\|(4), \fItcpdump\fR\|(1)
.SH "NOTES"
.IX Header "NOTES"
\&\fBSshdump\fR is part of the \fBWireshark\fR distribution.  The latest version
of \fBWireshark\fR can be found at <https://www.wireshark.org>.
.PP
\&\s-1HTML\s0 versions of the Wireshark project man pages are available at:
<https://www.wireshark.org/docs/man\-pages>.
.SH "AUTHORS"
.IX Header "AUTHORS"
.Vb 3
\&  Original Author
\&  \-\-\-\-\-\-\-\- \-\-\-\-\-\-
\&  Dario Lombardo             <lomato[AT]gmail.com>
.Ve