The situationI would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH to my local machine (Ubuntu) which has Wireshark installed. The problemI cannot login to the server with a root account because that is disabled. I have sudo rights, but when logged in to the server the command sudo tcpdump does not work. The command below (with or without sudo) won't work:$ ssh john@server-abc.com sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22 > /tmp/remoteThe questionIs there a way to get this working? If so - how?
Piping tcpdump traffic via SSH - but no root ssh access
ssh;centos;sudo;tcpdump
You can run this command via sudo on the server to capture the data first, and then send the resulting file back to your workstation to review the data  sudo tcpdump -i eth0 -s 65535 -w /tmp/wireshark