Read PCAP from remote machines into local Wireshark via SSH

remote-wireshark.sh

#!/bin/bash

function wshark() {
  PCAP_FILTER="not port 22"
  TCPDUMP="tcpdump -U -s0 -w -"

  unset SSH_HOST

  OPTIND=1
  while getopts ":f:h:s" opt
  do
    case ${opt} in
      f)
        PCAP_FILTER="${OPTARG}"
        ;;
      h)
        SSH_HOST="${OPTARG}"
        ;;
      s)
        TCPDUMP="sudo ${TCPDUMP}"
        ;;
      \?)
        echo "Invalid option: -${OPTARG}" >&2
        return 1
        ;;
      :)
        echo "Error: Option -${OPTARG} requires an argument" >&2
        return 1
        ;;
    esac
  done

  if [ -z ${SSH_HOST} ]
  then
    echo "Error: no SSH_HOST defined"
    echo "Usage: wshark -h SSH_HOST [-s] [-f 'PCAP_FILTER']"
    return 1
  else
    ssh ${SSH_HOST} "${TCPDUMP} '${PCAP_FILTER}'" | wireshark -k -i -
  fi
}