sshdig --help

sshdig --version

sshdig --extcap-interfaces

interface {value=sshdig}{display=SSH remote syscall capture}

sshdig --extcap-interface=sshdig --extcap-dlts

dlt {number=147}{name=sshdig}{display=Remote capture dependent DLT}

sshdig --extcap-interface=sshdig --extcap-config

arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}{tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}{default=22}{tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}{tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}{tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}{tooltip=The path on the local filesystem of the private SSH key (OpenSSH format)}{mustexist=true}{group=Authentication}
arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}{tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
arg {number=6}{call=--proxycommand}{display=ProxyCommand}{type=string}{tooltip=The command to use as proxy for the SSH connection}{group=Authentication}
arg {number=7}{call=--ssh-sha1}{display=Support SHA-1 keys (deprecated)}{type=boolflag}{tooltip=Support keys and key exchange algorithms using SHA-1 (deprecated)}{group=Authentication}
arg {number=8}{call=--remote-capture-command-select}{display=Remote capture command selection}{type=radio}{tooltip=The remote capture command to build a command line for}{group=Capture}
value {arg=8}{value=sysdig}{display=sysdig}
value {arg=8}{value=other}{display=Other:}
arg {number=9}{call=--remote-capture-command}{display=Remote capture command}{type=string}{tooltip=The remote command used to capture}{group=Capture}
arg {number=10}{call=--remote-priv}{display=Gain capture privilege on the remote machine}{type=radio}{tooltip=Optionally prepend the capture command with sudo or doas on the remote machine}{group=Capture}
value {arg=10}{value=none}{display=none}{default=true}
value {arg=10}{value=sudo}{display=sudo}
value {arg=10}{value=doas -n}{display=doas}
arg {number=11}{call=--remote-priv-user}{display=Privileged user name for sudo or doas}{type=string}{tooltip=User name of privileged user to execute the capture command on the remote machine}{group=Capture}
{group=Capture}
arg {number=12}{call=--remote-count}{display=Packets to capture}{type=unsigned}{default=0}{tooltip=The number of remote packets to capture. (Default: inf)}{group=Capture}
arg {number=13}{call=--log-level}{display=Set the log level}{type=selector}{tooltip=Set the log level}{required=false}{group=Debug}
value {arg=13}{value=message}{display=Message}{default=true}
value {arg=13}{value=info}{display=Info}
value {arg=13}{value=debug}{display=Debug}
value {arg=13}{value=noisy}{display=Noisy}
arg {number=14}{call=--log-file}{display=Use a file for logging}{type=fileselect}{tooltip=Set a file where log messages are written}{required=false}{group=Debug}

sshdig --extcap-interface=sshdig --fifo=/tmp/ssh.scap --capture --remote-host 192.168.1.10
--remote-username user

برای اطمینان از خاتمه تمیز فرآیند، باید از CTRL + C برای متوقف کردن ضبط استفاده شود.