EdgeRouter Wireshark Remote Packet Capture

Captures real time packets of an EdgeRouter interface and forwards them to Wireshark over an SSH connection.

Project Site

Prerequisites:

• Wireshark v3.2.3 or higher
• SSH-RSA Key setup on your EdgeRouter

Example

bash ./wiresharkedgerouter.sh -u ubnt -s 192.168.1.1 -p 22 -i eth0 -f "host not 1.1.1.1"

Parameters:

-u User: this is the user of the EdgeRouter you will be connecting with

-s Server: The IP or hostname of the EdgeRouter

-p SSH Port (optional | default: 22): The listen port on the EdgeRouter. Use this if 22 is not the default listening port or if port forwarding is setup to another port.

-i Interface: The interface on the EdgeRouter you want to listen to. e.g eth0

-f Filter (optional): If you want to filter traffic before forwarding to Wireshark. Using this will reduce the bandwidth over the SSH connection. Use if you have limit connection speed. Filters will need to be inclosed in quotes " ". Also, this parameter uses tcpdump syntax (not Wireshark's Syntax)

• tcpdump man pages
• Helpful tcpdump rules

Disclamer:

This code has only been tested on MacOS Catalina with Wireshark v3.2.3