Wireshark remote packet capture

1. Enable the rpcapd service on the remote host

Take windows as an example. Check that Winpcap has been installed, switch to the Winpcap directory, and run

Rpcapd-B IP address-P port number-l IP address of the host that allows remote packet capture-n

The specific usage of rpcapd can be queried through rpcapd-H.

2. Open the local Wireshark, capture ----> options ----> Manage interfaces ----> remote interfaces ----> Add, and enter the remote address. Wireshark may have different interfaces in different versions, but you can find interfaces similar to the above.