Ask Your Question

Revision history [back]

MacOS wireshark Remote Capture issue.

Hi, friends:

I asked a question about wireshark Remote Capture in there:

https://stackoverflow.com/questions/63918952/wireshark-remote-capture-failednflog-link-layer-type-filtering-not-implemented

please help with me.

MacOS wireshark Remote Capture issue.

Hi, friends:

I asked a question about wireshark Remote Capture in there:

https://stackoverflow.com/questions/63918952/wireshark-remote-capture-failednflog-link-layer-type-filtering-not-implemented

please help with me.


The detail information:

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` Capturing on 'nflog' dumpcap: Invalid capture filter "not port 22" for interface nflog!

That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software display the error: k


EDIT-01

I use the below command to special the interface: ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device: enter image description here

in my server there exist the em1 indeed. [[email protected] ~]# ip a | grep em1 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet remote-ip/29 brd remote-ip scope global noprefixroute em1

MacOS wireshark Remote Capture issue.

Hi, friends:

I asked a question about wireshark Remote Capture in there:

https://stackoverflow.com/questions/63918952/wireshark-remote-capture-failednflog-link-layer-type-filtering-not-implemented

please help with me.


The detail information:

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` Capturing on 'nflog' dumpcap: Invalid capture filter "not port 22" for interface nflog!

That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software display the error: k


EDIT-01

I use the below command to special the interface: interface:

ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device: device:

enter image description here

in my server there exist the em1 indeed. indeed.

[[email protected] ~]# ip a | grep em1 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet remote-ip/29 brd remote-ip scope global noprefixroute em1

click to hide/show revision 4
None

MacOS wireshark Remote Capture issue.

Hi, friends:

I asked a question about wireshark Remote Capture in there:

https://stackoverflow.com/questions/63918952/wireshark-remote-capture-failednflog-link-layer-type-filtering-not-implemented

please help with me.


The detail information:

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` Capturing on 'nflog' dumpcap: Invalid capture filter "not port 22" for interface nflog!

That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software display the error: k


EDIT-01

displayed an error dialog with

End of file pipe magic during open.

I use the below command to special the interface:

ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device:

enter image description here

device, with an error dialog

The capture session could not be initiated
on interface 'em1' (No such device exists).

Please check that you have the proper
interface or pipe specified.

in my server there exist the em1 indeed.

[[email protected] ~]# ip a | grep em1 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet remote-ip/29 brd remote-ip scope global noprefixroute em1

click to hide/show revision 5
None

MacOS wireshark Remote Capture issue.

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` Capturing on 'nflog' dumpcap: Invalid capture filter "not port 22" for interface nflog!

That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software displayed an error dialog with

End of file pipe magic during open.

I use the below command to special the interface:

ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device, with an error dialog

The capture session could not be initiated
on interface 'em1' (No such device exists).

Please check that you have the proper
interface or pipe specified.

in my server there exist the em1 indeed.

[[email protected] ~]# ip a | grep em1 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet remote-ip/29 brd remote-ip scope global noprefixroute em1

MacOS wireshark Remote Capture issue.Problem trying to capture on a remote machine using ssh to run dumpcap on the remote machine

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` Capturing on 'nflog' dumpcap: Invalid capture filter "not port 22" for interface nflog!

That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software displayed an error dialog with

End of file pipe magic during open.

I use the below command to special the interface:

ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device, with an error dialog

The capture session could not be initiated
on interface 'em1' (No such device exists).

Please check that you have the proper
interface or pipe specified.

in my server there exist the em1 indeed.

[[email protected] ~]# ip a | grep em1 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet remote-ip/29 brd remote-ip scope global noprefixroute em1


EDIT-01

I print the interfaces:

$ ssh [email protected] -i .ssh/id_rsa 'dumpcap -D' 1. bridge0 2. docker0 3. nflog 4. nfqueue 5. em1 6. usbmon1 7. em2 8. veth8b8f97a 9. vethfe9fbcf 10. br-eb92c719d431 11. veth5587e98 12. any 13. lo (Loopback)

Problem trying to capture on a remote machine using ssh to run dumpcap on the remote machine

I followed the official documentation.

My remote-server is CentOS 7.9, and I have installed the wireshark in it.

I use the below command to open my local wireshark software to capture the remote-server's interface packet:

ssh [email protected] 'dumpcap -w - -f "not port 22"' | wireshark -k -i -

but I get error information: ``` information:

Capturing on 'nflog'
dumpcap: Invalid capture filter "not port 22" for interface nflog!

nflog! That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented). See the User's Guide for a description of the capture filter syntax. ```

and my local wireshark software displayed an error dialog with

End of file pipe magic during open.

I use the below command to special the interface:

ssh [email protected] -i .ssh/id_rsa 'dumpcap -w - -f "not port 22"' | wireshark -k -i em1

but the wireshark says there is no such device, with an error dialog

The capture session could not be initiated
on interface 'em1' (No such device exists).

Please check that you have the proper
interface or pipe specified.

in my server there exist the em1 indeed.

[[email protected] ~]# ip a | grep em1
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
 inet remote-ip/29 brd remote-ip scope global noprefixroute em1


EDIT-01

I print the interfaces:

$ ssh [email protected] -i .ssh/id_rsa 'dumpcap -D'
1. bridge0
2. docker0
3. nflog
4. nfqueue
5. em1
6. usbmon1
7. em2
8. veth8b8f97a
9. vethfe9fbcf
10. br-eb92c719d431
11. veth5587e98
12. any
13. lo (Loopback)