Remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

gatewayremotesshtcpdumpwireshark

I (Host A – Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to Host A (through Host B I assume), and opened, in real time, with Wireshark on Host A:

Below is what I saw as the command when not using a gateway ("direct remote fetch"). So, how would I make this work going through my gateway host B scenario above?

Host A$ plink.exe -ssh -pw abc123 root@Host C "tcpdump -s0 -U -n -w – -i eth0 not port 22" | "C:\Program Files\Wireshark\Wireshark.exe" -k -i –

Best Answer

There's the equivalent of OpenSSH ProxyCommand:

plink -proxycmd "plink -nc %host:%port user@HostB" root@HostC ...

Plain nested commands should work just as well (the -A option for SSH agent forwarding is useful in this case):

plink user@HostB "ssh root@HostC tcpdump ..." | wireshark
Related Question