Pasted

RHEL6 Requirements:
geoip-1.4.6-1.el6.rf.x86_64.rpm
libsmi-0.4.8-4.el6.x86_64.rpm
wireshark-1.10.0-1.el6.rft.x86_64.rpm
wireshark-gnome-1.10.0-1.el6.rft.x86_64.rpm
zlib-1.2.3-29.el6.x86_64.rpm
 
For remote capture readings:
coreutils-8.4-43.el6.x86_64.rpm
coreutils-libs-8.4-43.el6.x86_64.rpm
 
 
Create a named pipe:
mkfifo /tmp/packet_capture
 
Start wireshark from the command line
wireshark -k -i /tmp/packet_capture
 
Run tcpdump over ssh on your remote machine and redirect the packets to the named pipe (find the eth interface):
ssh root@source-hostname "tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/packet_capture
 
Source: http://blog.nielshorn.net/2010/02/using-wireshark-with-remote-capturing/
 
Filters
===
 
Find duplicate ip addresses:
arp.duplicate-address-detected
 
Exclude a destination ip address
NOT(ip.dst == 10.15.30.114)
 
Exclude a source ip address
NOT(ip.src == 10.15.30.114)