How to Enable Remote Packet Capture with Wireshark

Just in case anyone wants to use a mac to do this remote capture… I finally spent some time and figured out a way.

You will need two terminal windows open. One to create the FIFO pipe and start the netcat listener. The other to start Wireshark.

Terminal 1
mkfifo /path/to/packetbuffer
chmod 777 /path/to/packetbuffer (*this step may not be required)
sudo nc -l 12345 > /path/to/packetbuffer

Terminal 2
wireshark -k -i /path/to/packetbuffer

Wireshark should open up. Start the remote capture on the peplink device.

Happy capturing!

5 Likes