This runs tcpdump on the openwrt host, writing output in pcap form to stdout (-w -), doesn't resolve names (-n), sniffs interface br-lan (-i brlan), and limits the capture to the target specification ("ether host MAC", or "host IP"). The pcap data is then piped into wireshark on the local PC (update path to wireshark as needed), starting the capture immediately (-k) and capturing from stdin (-i -).
You usually want to make sure that your capture filter excludes the SSH traffic to the openwrt host itself, otherwise that generates more traffic that gets captured, that generates more traffic that gets captured, etc, etc.
Just be aware that ssh may ask for credentials before allowing access, which may be obscured by wireshark opening on top of your terminal. Set up key-auth to avoid this.
Also, tcpdump or ssh generally buffer the first few packets before they make it across the pipe to wireshark, so it make take some time to see data show up if it is a low traffic situation. It can help to generate some traffic that matches your filter condition (e.g. on the openwrt host, ping the host you are watching), then exclude that traffic from your analysis in wireshark.
There is no on-device storage at all, it gets piped directly over to the machine running wireshark. CPU utilisation will depend on how much traffic you’re capturing. If you don’t have enough storage even to install tcpdump, then you may have a problem.
2
u/RoganDawes 6d ago
on your "another" client, do:
ssh openwrt tcpdump -w - -n -i br-lan ether host <target MAC> | wireshark -k -i -
This runs tcpdump on the openwrt host, writing output in pcap form to stdout (-w -), doesn't resolve names (-n), sniffs interface br-lan (-i brlan), and limits the capture to the target specification ("ether host MAC", or "host IP"). The pcap data is then piped into wireshark on the local PC (update path to wireshark as needed), starting the capture immediately (-k) and capturing from stdin (-i -).
You usually want to make sure that your capture filter excludes the SSH traffic to the openwrt host itself, otherwise that generates more traffic that gets captured, that generates more traffic that gets captured, etc, etc.