Pipe tcpdump from two machines to wireshark in my local machine

Question

Hi
My computer is running on windows 7. I need to do tcpdump on two different linux machines (machine2 and 3) that are only accessible from another linux machine (machine1) which is the only one I have access to, then pipe both of them results to my laptop to one instance of wireshark. Is this possible to be done?. Or at least to only one machine? If this is possible could you please explain to me how can this be done, or any alternative. In summary

client(windows-wireshark) -> linux(machine1) -> linux(machine2-tcpdump)    
                                             -> linux(machine3-tcpdump)

Thanks in advance.

Answer 1

Okay, so we have two points to address:

how to make plink reach machine 2 (3) via machine 1,
how to make Wireshark capture from two queues simultaneously.

The first one is easy: you use one instance of plink to log in to machine1 and set up a tunnel through that ssh session from your Windows machine's local tcp port to machine2's tcp port 22 the following way:

start "c:\Program Files (x86)\PuTTY\plink.exe" -ssh [email protected] -pw machine1_root_pwd -L 20022:machine2s_IP:22

machine2s_IP is the IP address of machine2 which machine1 can access.

This will open a new command line window for that instance of plink but won't prevent the script from continuing further. You can get rid of that extra window by using a /B option to the start command but I'd recommend you to do that only after you debug the whole solution.

On the next line of the batch, you start the plink as you did, except that you specify the socket on your local machine as the server:

"c:\Program Files (x86)\PuTTY\plink.exe" -ssh [email protected] -P 20022 -pw mchn2_root_pwd "tcpdump -i eth1 -s 0 -U -n -w - 'tcp port not 22'" | wireshark ...

The second part is a bit of a headache. I've asked you on purpose whether you've already used a named pipe. The trouble is that you cannot feed Wireshark with two distinct streams through the (single) standard input (using -i -, you tell Wireshark to read the capture from standard input rather than a physical interface), so you'd have to use two distinct named pipes.

But while on linux it is possible to create and feed a named pipe from the command line, it seems not to be the case at Windows, so unless you'll find a ready-made solution, you'll need to write a piece of code in order to be able to set up the named pipes and feed them with the data output by the plink. So your command line options to Wireshark would be -k -i \\.\pipe\from-machine-2 -i \\.\pipe\from-machine-3, and you would have to start Wireshark with these options only as late as when both pipes have already come into existence. To make things more complex, the -k is necessary; if you omit it and then start the capture manually in the Wireshark window, it fails. Some suggestions can be found at the Wireshark wiki on pipes. I use perl for the purpose, but I don't have a piece of code which would copy its standard input to the named queue and act as a buffer to temporarily store the input data as they arrive until Wireshark starts reading them.

So instead of using | to pipe plink's output straight to the standard input of Wireshark, you have to pipe it to that code:

start "c:\Program Files (x86)\PuTTY\plink.exe" -ssh [email protected] -P 20022 -pw mchn2_root_pwd "tcpdump -i eth1 -s 0 -U -n -w - 'tcp port not 22'" | your_pipe_writer from-machine-2

start "c:\Program Files (x86)\PuTTY\plink.exe" -ssh [email protected] -P 30022 -pw mchn3_root_pwd "tcpdump -i eth1 -s 0 -U -n -w - 'tcp port not 22'" | your_pipe_writer from-machine-3

And the last point is that despite what the Wiki says, Wireshark only accepts pcap (i.e. not pcapng) data format through stdin or named pipes, so depending on your tcpdump version, you may need to use the right option to make it output pcap. This excludes capturing on more than one interface by the same instance of tcpdump, i.e. in a generic case you'd need one tcpdump instance and named pipe per each source interface.