RSniffer
==================================================
RSniffer is a small tool, that allows to send pcap stream to remote host for futher analysis.
Main idea is to analyze traffic of the linux server using GUI Wireshark on desktop PC.
Optionally you can collect the traffic of several servers into dedicated trace server.
Usage scheme:
(Linux server) RSniffer ==[UDP TZSP/ERSPAN stream]==> (Linux/windows desktop) GUI Wireshark
How to run without ROOT privileges
==================================================
Normally rsniffer requires root privilleges to listen interfaces.
So, you can run it from root user or via sudo.
But there is an alternative solution - use setcap to grant rsniffer binary with required privileges.
Just run the following command:
[root@server ~]# setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' ./rsniffer
HELP
==================================================
rsniffer: capture packets via libpcap and transmit captured flow to external box using TZSP or ERSPAN protocol.
Usage: ./rsniffer [-h] [-l] [-E] [-s] [-i INTERFACE] [-p DEST_PORT] DEST_HOST FILTER_RULE
./rsniffer -l
-v Show version
-l List available INTERFACEs
-h Display this message
-i Capture interface (default: first interface)
-p Destination UDP port (default: 37008)
-E Use ERSPAN protocol (default: TZSP)
-s Silent: do not print counters during processing
-x TZSP: Add packet counter tag
DEST_HOST Send UDP flow to specified host
FILTER_RULE Filter rule for pcap library
How to compile
==================================================
RSniffer requires pcap-devel library to be installed on your server.
Additionally you also need:
gcc
make
libpcap-dev