SSHDUMP(1) SSHDUMP(1) (NAME) sshdump - SSH . (SYNOPSIS) sshdump [ --help ] [ --version ] [ --extcap-interfaces ] [ --extcap-dlts ] [ --extcap-interface= ] [ --extcap-config ] [ --extcap-capture-filter= ] [ --capture ] [ --fifo= ] [ --remote-host= ] [ --remote-port= ] [ --remote-username= ] [ --remote-password= ] [ --sshkey= ] [ --sshkey-passphrase= ] [ --proxycommand= ] [ --remote-interface= ] [ --remote-capture-command-select= ] [ --remote-capture-command= ] [ --remote-priv= ] [ --remote-priv-user= ] [ --remote-noprom ] [ --remote-filter= ] [ --remote-count= ] sshdump --extcap-interfaces sshdump --extcap-interface= --extcap-dlts sshdump --extcap-interface= --extcap-config sshdump --extcap-interface= --fifo= --capture --remote-host=myremotehost --remote-port=22 --remote-username=user --remote-interface=eth2 --remote-capture-command='tcpdump -U -i eth0 -w-' (DESCRIPTION) Sshdump extcap SSH . . : $ ssh remoteuser@remotehost -p 22222 'tcpdump -U -i IFACE -w -' > FILE & $ wireshark FILE $ ssh remoteuser@remotehost '/sbin/dumpcap -i IFACE -P -w - -f "not port 22"' > FILE & $ wireshark FILE $ ssh somehost dumpcap -P -w - -f udp | tshark -i - sshdump . Wireshark . Wireshark remotehost : $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' -i sshdump -k : $ wireshark '-oextcap.sshdump.remotehost:"remotehost"' \ '-oextcap.sshdump.remotecapturecommand:"tcpdump -i eth0 -Uw- not port 22"' \ -i sshdump -k : 1. sshdump --help . --version . --extcap-interfaces . --extcap-interface= . --extcap-dlts DLT . --extcap-config . --extcap-capture-filter= (capture filter). tshark -f Capture Filter Wireshark . --capture --fifo . --fifo= (pipe). --remote-host= . --remote-port= SSH . --remote-username= SSH. --remote-password= ( ssh-agent ). : (plaintext) . SSH agent . --sshkey= . : / OPENSSH . --sshkey-passphrase= . --proxycommand= SSH . --remote-interface= . --remote-capture-command-select= . dumpcap dumpcap tcpdump tcpdump other --remote-capture-command . dumpcap tcpdump . --remote-capture-command= Wireshark . PCAP STDOUT . . tcpdump -w- (stdout) . -U . (--extcap-capture-filter) . --remote-priv= none sudo doas. --remote-priv-user= . . --remote-filter= . tshark -f Capture Filter Wireshark . --remote-count= . : sshdump --help : sshdump --version : sshdump --extcap-interfaces (sshdump) . interface {value=sshdump}{display=SSH remote capture} DLT : sshdump --extcap-interface=sshdump --extcap-dlts dlt {number=147}{name=sshdump}{display=Remote capture dependent DLT} : sshdump --extcap-interface=sshdump --extcap-config arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string} {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server} arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}{default=22} {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server} arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string} {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication} arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password} {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication} arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect} {tooltip=The path on the local filesystem of the private SSH key (OpenSSH format)}{mustexist=true}{group=Authentication} arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password} {tooltip=Passphrase to unlock the SSH private key}{group=Authentication} arg {number=6}{call=--proxycommand}{display=ProxyCommand}{type=string} {tooltip=The command to use as proxy for the SSH connection}{group=Authentication} arg {number=7}{call=--remote-interface}{display=Remote interface}{type=string} {tooltip=The remote network interface used for capture}{group=Capture} arg {number=8}{call=--remote-capture-command-select}{display=Remote capture command selection}{type=radio} {tooltip=The remote capture command to build a command line for}{group=Capture} value {arg=8}{value=dumpcap}{display=dumpcap} value {arg=8}{value=tcpdump}{display=tcpdump}{default=true} value {arg=8}{value=other}{display=Other:} arg {number=9}{call=--remote-capture-command}{display=Remote capture command}{type=string} {tooltip=The remote command used to capture}{group=Capture} arg {number=10}{call=--remote-priv}{display=Gain capture privilege on the remote machine}{type=radio} {tooltip=Optionally prepend the capture command with sudo or doas on the remote machine}{group=Capture} value {arg=10}{value=none}{display=none}{default=true} value {arg=10}{value=sudo}{display=sudo} value {arg=10}{value=doas -n}{display=doas} arg {number=11}{call=--remote-priv-user}{display=Privileged user name for sudo or doas}{type=string} {tooltip=User name of privileged user to execute the capture command on the remote machine}{group=Capture} arg {number=12}{call=--remote-noprom}{display=No promiscuous mode}{type=boolflag} {tooltip=Don't use promiscuous mode on the remote machine}{group=Capture} arg {number=13}{call=--remote-filter}{display=Remote capture filter}{type=string} {tooltip=The remote capture filter}{default=not ((host myhost) and port 22)}{group=Capture} arg {number=14}{call=--remote-count}{display=Packets to capture}{type=unsigned}{default=0} {tooltip=The number of remote packets to capture. (Default: inf)}{group=Capture} arg {number=15}{call=--log-level}{display=Set the log level}{type=selector} {tooltip=Set the log level}{required=false}{group=Debug} value {arg=14}{value=message}{display=Message}{default=true} value {arg=14}{value=info}{display=Info} value {arg=14}{value=debug}{display=Debug} value {arg=14}{value=noisy}{display=Noisy} arg {number=16}{call=--log-file}{display=Use a file for logging}{type=fileselect} {tooltip=Set a file where log messages are written}{required=false}{group=Debug} : sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10 --remote-username user --remote-filter "not port 22" : sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10 --remote-username user --remote-priv sudo --remote-capture-command-select tcpdump --remote-interface eth0 --remote-noprom sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10 --remote-capture-command='dumpcap -i eth0 -P -w -' sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10 --remote-capture-command='sudo tcpdump -i eth0 -U -w -' CTRL+C kill/terminate . sshdump . sshdump wireshark ( ) sshdump sshdump-host1 sshdump-host2 . . "sshdump" "custom version" . (SEE ALSO) wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1) (NOTES) Sshdump Wireshark . Wireshark . HTML Wireshark : . (AUTHORS) Dario Lombardo 2026-09-03 SSHDUMP(1)