Wireshark · Ethereal-dev: Re: [Ethereal-dev] ISUP/MTP support

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 18, 2003, at 8:15 AM, Chris Wilson wrote:

> I'm thinking of hacking with text2pcap to produce text2tun (using the 
> same parser) - the idea is to allow realtime capture on remote 
> machines - by doing something along the lines of:
>
> ssh -C someserver tcpdump -X -s 0 -n -p -i eth0 tcp port 8080 | 
> text2tun

At least on UNIX systems, Ethereal can capture from a named pipe file 
as well as from a device openable with "pcap_open_live()" - that was 
put in for, among other things, doing remote captures by

	creating a FIFO file;

	doing something such as

		ssh -C someserver tcpdump -s 0 -p -i eth0 -w - >/tmp/FIFO

	"capturing" from "/dev/FIFO" (specify "/dev/FIFO" as the capture 
device)

This avoids the binary-to-hex-as-text and hex-as-text-to-binary 
conversions your example does.