Look at the `SSH remote capture: sshdump`. https://www.wireshark.org/docs/man-pages/sshdump.html
Wireshark can SSH into the remote machine, perform the capture, then show the packets in your local instance of Wireshark.
It's a bit of a nuisance to setup of course, tshark has a bit less friction here, and TUIs are always cool.
ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k
This looks nicer, but X forwarding is a generic solution to displaying GUIs locally while running them remotely.
It is more likely easier to build / install this on a remote server than to have X11 forwarding.
- X11 fwd is often disabled in sshd config, as it introduces a number of backchannels for a compromised server to leak to the client.
- If you're working on a remote _server_, it is very unlikely that an X client will be available there. Building an X client & it's dependencies as non-root is a thousand times worst than building such a small TUI. Been there, done that.
- Remote X11 is horribly slow, you'll most likely want some more modern variant (x2go & co), which will be a nightmare to build, or tunnel.
termshark, being written in go, has zero (0) extra packages other than tshark.
Thanks!
Another "why": you want to do live capture and analysis, but don't want to run a GUI program as root for a variety of reasons.