Tshark

From Cheatsheet

Command line version of wireshark, which used to be ethereal, but if you want to sniff network traffic remotely via ssh terminal, this is how you would do it. Most of this is in Debian Etch, but other OS'es should'nt be terribly different.

Installation

 apt-get install tshark wireshark-common

Usage

http://medgarnet.blogspot.com/2007/10/tshark-filter-example.html