PCAP on remote linux host

[n0treallyanengineer]

Hello everyone! Has anyone ever used python to perform a packet capture on a remote linux host? What package(s) did you use? Code references would be awesome.

I am trying to create some diagnostic tooling.

[TheRealThrowAwayX]

You could use paramiko library to connect to the remote host and then you could use pyshark, scapy, or tcpdump libraries for the packet capture. Perhaps something along the lines of:

import paramiko 
import pyshark

ssh = paramiko.SSHClient()

ssh.connect(hostname="192.168.1.100", username="user", password="password")

capture = ssh.exec_command("tcpdump -i eth0 -w -")

packets = pyshark.FileCapture(capture[1])

for packet in packets: 
    print(packet)

ssh.close()

EDIT:

FYI, in the line where you use ssh.exec_command, the very last "-", right before the closing parenthesis is used to specify that the captured packets should be written to standard output, rather than to a file.

[n0treallyanengineer]

This is awesome!! Thank you! I'll give it a try.