tcpdump with Wireshark: Capture Remotely, Analyze Locally (2026)

You can capture network traffic from a remote server and analyze it on your local machine using tcpdump and Wireshark.

Let’s see this in action. Imagine you’re troubleshooting a sluggish web application running on 192.168.1.100 from your laptop at 192.168.1.50. The server is experiencing intermittent connectivity issues, and you need to see the raw network packets.

First, on your local machine, you’ll start a netcat listener to receive the tcpdump output.

nc -l -p 12345 > capture.pcap

Here, nc (netcat) is set to listen (-l) on port 12345. All incoming data will be redirected (>) to a file named capture.pcap. This file will eventually contain the raw packet data from the remote server.

Now, on the remote server (192.168.1.100), you’ll use tcpdump to capture traffic and pipe it directly to netcat, which will send it over the network to your local machine’s netcat listener.

sudo tcpdump -i eth0 -w - 'host 192.168.1.100 and port 80' | nc 192.168.1.50 12345

Let’s break this down:

• sudo tcpdump: You need root privileges to capture network traffic.
• -i eth0: Specifies the network interface to capture from. Replace eth0 with the actual interface name on your server (e.g., ens160, enp0s3). You can find this using ip addr show or ifconfig.
• -w -: This is crucial. -w tells tcpdump to write the output in pcap format (which Wireshark understands). The hyphen (-) tells it to write to standard output, rather than a file. This allows us to pipe the data.
• 'host 192.168.1.100 and port 80': This is a filter expression. It tells tcpdump to only capture packets that are either originating from or destined for 192.168.1.100 AND are on port 80 (HTTP). You can adjust this filter to include other ports (e.g., port 443 for HTTPS) or hosts.
• |: The pipe symbol sends the standard output of tcpdump to the standard input of the next command.
• nc 192.168.1.50 12345: This is your netcat command on the remote server. It connects to your local machine’s IP address (192.168.1.50) on port 12345 and sends all the data it receives from tcpdump over that connection.

Once you’ve captured enough data, stop tcpdump on the server (usually with Ctrl+C). The capture.pcap file on your local machine will be populated. You can then open this capture.pcap file directly in Wireshark for detailed analysis.

This setup is incredibly useful for diagnosing issues on servers that you can’t directly access with Wireshark, especially in cloud environments or when dealing with transient problems. It allows you to get a granular view of network communication without needing to install Wireshark on the production server itself.

When you’re analyzing the capture.pcap file in Wireshark, pay close attention to TCP retransmissions, duplicate ACKs, and packet loss indicators. These are often the smoking guns for network-related performance problems. You can filter within Wireshark using similar expressions to what you used with tcpdump, like tcp.analysis.retransmission or ip.addr == 192.168.1.100.

A common pitfall is forgetting to include the -w - option in tcpdump. Without it, tcpdump will print human-readable packet summaries to standard output, which netcat will interpret as text, corrupting the pcap data. Another is using an incorrect interface name or an overly broad filter that generates too much data, saturating the network link between the server and your laptop.

The next step in analyzing network performance might involve using tools like iperf3 to benchmark throughput between the client and server, or delving into application-level logs to correlate network events with application behavior.