A couple days ago, this command was working:
I was able to open wireshark on my local machine with that command, and I was able to see the packets arriving in wireshark as the remote host was capturing them. Then I closed wireshark, which ended the command. I tried running the command again a second time (the exact same command) and it no longer worked. I've also tried rebooting my machine, but to no avail. If I run it with "cat -" instead of wireshark, I see a constant stream of packets.
It will keep outputting the packets to my terminal until I end it with Ctrl C. But if I do it with wireshark, I get the following output:
As you can see, only 19 packets came through before the trace mysteriously ended. Those packets were not displayed in wireshark. My setup is a local Windows 7 laptop with Wireshark Version 2.2.4 (v2.2.4-0-gcc3dc1b), and I am running those commands in Cygwin. At the time that the command was working, I was also able to open wireshark to watch packets from another remote host, with this command:
I don't think all of the interfaces were working (it might have just been capturing on Any help in diagnosing this issue is greatly appreciated. asked 10 Feb '17, 08:00 Lemurshark |
I don't have an answer for you, as this always worked for me in my testing, but something to check - is
tcpdump
still running on the remote host? Only when I logged into the remote host and manually killedtcpdump
, then I saw the capture summary information; otherwise I'd never see. Also, as far as I know,tcpdump
only accepts a single interface for its-i
option, so if you specify more than one, only the last one will be the active interface upon which it captures.