Since the tcpdump command runs in a terminal mode, it’s possible to launch it through an SSH session. It’s not as easy to use as Wireshark, but it’s just as capable of capturing traffic. Tcpdump is a command-line packet analyzer. Sometimes it’s easier to capture traffic on the remote server, then analyze it on your desktop. Unless you have special networking equipment, this can be difficult.

While Wireshark does a great job of capturing every packet that flows past it, in some cases you’ll need to analyze a session from a remote server.

While Wireshark does a great job of capturing every network packet that flows past it, in some cases you’ll need to analyze a session from a remote server. Sometimes the easiest solution is to use tcpdump to capture traffic on the remote server, and then run Wireshark to take a look at it. Unless you have professional networking equipment, it’s hard to analyze traffic that doesn’t involve your computer.

Wireshark is a powerful tool, but it has its limitations.

Wireshark command line for windows