How to Capture Remote System network traffic?

Question

I have been using wire-shark to analyse the packets of socket programs, Now i want to see the traffic of other hosts traffic, as i found that i need to use monitor mode that is only supported in Linux platform, so i tried but i couldn't capture any packets that is transferred in my network, listing as 0 packets captured.

Scenario:

I'm having a network consisting of 50+ hosts (all are powered by windows Except mine), my IP address is 192.168.1.10, when i initiate a communication between any 192.168.1.xx it showing the captured traffic. But my requirement is to monitor the traffic of 192.168.1.21 b/w 192.168.1.22 from my host i,e. from 192.168.1.10.

1: is it possible to capture the traffic as i mentioned?

2: If it is possible then is wire-shark is right tool for it (or should i have to use differnt one)?

3: if it is not possible, then why?

Answer 1

Just adapt this a bit with your own filters and ips : (on local host)

ssh -l root <REMOTE HOST> tshark -w - not tcp port 22 | wireshark -k -i -

or using bash :

wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22)

You can use tcpdump instead of tshark if needed :

ssh -l root <REMOTE HOST> tcpdump -U -s0 -w - -i eth0 'port 22' |
     wireshark -k -i -