mkfifo /tmp/packet_capture

2. Second give the following ssh command on your terminal, to start the tcpdump on remote PC.

ssh hostname_or_ip_of_remote_pc "tcpdump -s 0 -U -n -w - -i eth0 not port 22" 
 > /tmp/packet_capture

3. Third & last step, give the following command to start the WireShark on your PC, which will read packets from the special FIFO file ‘/tmp/packet_capture’ at runtime.

wireshark -k -i /tmp/packet_capture

After giving the above command all the packets of remote pc’s eth0 will be visible on WireShark.

SSH server can’t work independently, it require SSH server (like dropbear) to run. Dropbear require libz & libcrypto to run, so please first install them (if not install already). To install the dropbear SSH server, follow the steps given below.

-bash-3.2# tar –xvf dropbear-0.52.tar.bz2

-bash-3.2# cd dropbear-0.52

-bash-3.2# ./configure

-bash-3.2# make PROGRAMS=”dropbear dbclient dropbearkey dropbearconvert scp”

-bash-3.2# make PROGRAMS=”dropbear dbclient dropbearkey dropbearconvert scp” install

It will install the dropbear SSH server. Now you can create the softlink of dbclient as ssh. It is not mandatory, you can also use dbclient instead of ssh command.

-bash-3.2# ln –s /usr/local/bin/dbclient /usr/bin/ssh

To start the dropbear SSH server, first create the dss & rsa keys (for the encryption of SSH packets) in /etc/dropbear directory. SSH server does work without encryption, so it is mandatory to create the keys.

-bash-3.2# dropbearkey –t dss –f /etc/dropbear/dropbear_dss_host_key

-bash-3.2# dropbearkey –t rsa –f /etc/dropbear/dropbear_rsa_host_key

Now dropbear can be started simply by following command.

-bash-3.2# dropbear

If above will done properly you can connect your system via SSH.

View Complete Topic