Ask Your Question

Remote ssh capture does not work on Windows 10

asked 2021-02-03 19:07:45 +0000

myky gravatar image

updated 2021-02-03 19:13:22 +0000

Hi all,

It used to work, but with some recent updates, it broke. Wireshark and router FW were updated, so not 100% on which side the fault is, the user maybe :)

Error message in the link below:

It complains about: Unable to write to standard output: The pipe is being closed.

Any help?

Thanks, Myky

edit retag flag offensive close merge delete


What is output of wireshark -v?

Chuckc gravatar imageChuckc ( 2021-02-03 19:36:19 +0000 )edit

Sorry for not providing that info initially. Please see below:

C:\Program Files\Wireshark>

Wireshark 3.4.3 (v3.4.3-0-g6ae6cd335aa9)

It's the latest.

myky gravatar imagemyky ( 2021-02-03 20:01:25 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2021-02-03 20:36:41 +0000

Chuckc gravatar image

Similar question - Windows remote ssh capture not getting packets

1. For test, send output to a file (plink.exe ..... > test.pcap) then open the file with Wireshark.
2. Has this syntax working in the past without -w - option for tcpdump?

edit flag offensive delete link more


What a magic command right click > run as administrator )) When l started my CMD with admin rights, boom, l can see packets.

Thanks Chuckc!

myky gravatar imagemyky ( 2021-02-03 22:24:34 +0000 )edit

You could also use the built-in extcap (optional in the installer) sshdump to capture over an ssh connection. Note that on Windows, the ssh library used only supports ssh with username and password.

grahamb gravatar imagegrahamb ( 2021-02-04 09:25:30 +0000 )edit

Thanks. Never heard about that option. Will keep it in my tshoot box.

myky gravatar imagemyky ( 2021-02-04 09:52:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-02-03 19:07:45 +0000

Seen: 1,343 times

Last updated: Feb 03 '21