SHELL

SSH remote capture Wireshark

    sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
    --remote-username user --remote-filter "not port 22"

SSH remote capture Wireshark

    sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
    --remote-capture-command='dumpcap -i eth0 -P -w -'

    sshdump --extcap-interface=sshdump --fifo=/tmp/ssh.pcap --capture --remote-host 192.168.1.10
    --remote-capture-command='sudo tcpdump -i eth0 -U -w -'