[lexh]

I was delighted when I discovered that you can also pipe stdin into Wireshark (GUI). I've not seen a lot of GUI applications that support this flow.

e.g.

  > wireshark -k -i <(ssh -l root remote-host "dumpcap -P -w - -f 'not tcp port 22'")  

https://wiki.wireshark.org/CaptureSetup/Pipes.md#remote-capt...

[hamburglar]

I prefer a ‘not host <x>’ filter using info found in $SSH_CONNECTION to filtering all port 22 out, but yeah, good stuff.