Remote Wireless Packet Capture over SSH

When your adapter is physically closer to the target than your analysis workstation, or when you are running a Raspberry Pi or similar sensor in the field, you can stream the raw capture from the remote interface directly into a local Wireshark instance over SSH. No intermediate file is needed. The capture appears in Wireshark in real time as if the adapter were local.

The remote host needs tcpdump or tshark installed, SSH access, and the wireless interface in monitor mode.

Stream into Wireshark with tcpdump

The remote host captures with tcpdump and writes the raw bytes to stdout. SSH pipes them to the local machine where Wireshark reads from stdin:

-w - writes the pcap stream to stdout. -U flushes each packet immediately rather than buffering. Without -U there is a noticeable delay before frames appear in Wireshark. wireshark -k -i - opens Wireshark and immediately starts reading from stdin.

Filter on the Remote Host to Reduce Bandwidth

On a busy wireless channel the raw stream can saturate a slow SSH connection. Apply a BPF filter on the remote side to send only relevant frames:

BPF filters on 802.11 interfaces in monitor mode behave differently from Ethernet. Frame filtering by MAC address works but protocol-level filters may not apply correctly to raw 802.11 frames with radiotap headers. When in doubt, filter by BSSID on the remote side and apply display filters locally in Wireshark.

Stream with tshark for Field Filtering

tshark on the remote host applies proper 802.11 display filters before sending frames across the SSH tunnel, which gives more precise filtering than raw BPF:

This example strips beacon frames (subtype 8) before sending, which dramatically reduces stream volume on busy channels without losing any data frames or handshake traffic.

Save to a Local File Simultaneously

To stream into Wireshark and save to a local file at the same time, pipe through tee:

The local capture.pcap file receives the same stream as Wireshark. This is useful when the remote connection drops — you have the capture file locally and do not need to repeat the session.

Enable Monitor Mode on the Remote Host First

If the remote interface is not already in monitor mode, enable it over SSH before starting the capture stream:

Then start the capture stream in a second SSH command. Combining the monitor mode setup and the capture into a single SSH session can cause the capture to start before monitor mode is fully active on some adapters. Running them as separate commands avoids this.

Lock the Remote Interface to a Specific Channel

Channel hopping on the remote interface while streaming causes Wireshark to see frames from multiple channels mixed together, which makes analysis harder. Lock to the target channel before starting the stream:

Then start the tcpdump stream. Frames from a single locked channel are much easier to analyse for handshakes, authentication sequences, and client behaviour.