Sometimes it is useful to capture network traffic on a remote Linux device and analyze it directly on another server or workstation. This can be done easily by combining tcpdump with netcat (nc).
The remote system captures packets with tcpdump and streams the PCAP data over a TCP connection, while the receiving system can either display the packets in real time or save the complete capture to a file.
Listen and Analyze the Capture
On the receiving Linux system, start netcat on TCP port 12345 and pipe the received PCAP stream directly to tcpdump:
The options used by tcpdump are:
- -nn - disable hostname and service name resolution
- -e - display Ethernet headers
- -r - - read the PCAP data from standard input
Send the Remote Capture
On the remote device, capture traffic from the required interface and send it to the receiving system:
Replace eth0 with the required network interface and RECEIVER_IP with the IP address of the system running the netcat listener.
Save the Capture to a PCAP File
Instead of displaying the packets in real time, the receiving system can save the incoming capture directly to a PCAP file:
The resulting file can later be analyzed with tcpdump:
It can also be opened directly in Wireshark for more detailed packet analysis.
Example
Receiver with IP address 192.168.1.10:
Remote capture device:
Important
Netcat does not encrypt the connection. Use this method only on trusted networks or transport the connection through an encrypted tunnel such as SSH or a VPN when capturing traffic across untrusted networks.