If you're ok installing stuff on the remote side, which you'd need to be to run this anyway, I'd expect wireshark to work well with X forwarding.

This looks nicer, but X forwarding is a generic solution to displaying GUIs locally while running them remotely.

Installing wireshark on non-gui machines brings tons of junk.. just tried this on Ubuntu's minimal container with tshark installed -- and by default, wireshark brings in 206 extra packages, including python3 and systemd. It's a bit better with --no-install-recommends, but still 105 extra packages.

termshark, being written in go, has zero (0) extra packages other than tshark.

> If you're ok installing stuff on the remote side, which you'd need to be to run this anyway

It is more likely easier to build / install this on a remote server than to have X11 forwarding.

- X11 fwd is often disabled in sshd config, as it introduces a number of backchannels for a compromised server to leak to the client.

- If you're working on a remote _server_, it is very unlikely that an X client will be available there. Building an X client & it's dependencies as non-root is a thousand times worst than building such a small TUI. Been there, done that.

- Remote X11 is horribly slow, you'll most likely want some more modern variant (x2go & co), which will be a nightmare to build, or tunnel.

My remote machine, a cheap VPS VM, is too weak to support GUI. The network between my machine and VM is also too slow for that.

The other way to do it is ssh to remote box, `tcpdump -w foo.pcap` there, then bring it back by scp and you can open it for analysis in full wireshark.

You can even let tcpdump write packets to stdout, then pipe directly to your local wireshark and get a live view:

    ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k

makes sense to exclude port 22 from the dump =)

This works, but you won’t get the interface name in wireshark. If you also require the captured interface you can substitute tcpdump with tshark

I've used this method with success! +1

tshark includes the functionality of tcpdump and more

Wireshark supports this natively.

Look at the `SSH remote capture: sshdump`. https://www.wireshark.org/docs/man-pages/sshdump.html

Wireshark can SSH into the remote machine, perform the capture, then show the packets in your local instance of Wireshark.

It's a bit of a nuisance to setup of course, tshark has a bit less friction here, and TUIs are always cool.