Once you’ve finished capturing traffic, end the tcpdump session by pressing Ctrl+C In short, the above command will capture all traffic on the specified interface with -i option and write it to a file tcpdump_capture.pcap in a format compatible with Wireshark. ~]# tcpdump -s 0 -i ens192 -w tcpdump_Capture.pcap In order to capture packets remotely connect using SSH, Connect to the remote server and start tcpdump like below. The goal here is to capture the network traffic on a remote computer using tcpdump, download and analyse using wireshark. A local computer with Wireshark installed.Any service which can be used to generate network traffic, like Apache Webserver or a node server.A remote computer linux server with SSH enabled and tcpdump installed.In this post we are using tcpdump to capture packets from a remote machine and analyse it using Wireshark.

Where Wireshark is a desktop application that can be installed on multiple Operating Systems while tcpdump is a commandline utility mainly seen in Linux/Unix based Operating Systems. Wireshark and tcpdump is a free and open-source network packet analyzer.

Tcpdump wireshark pcap format