Capturing packets on remote host
ssh user@remote-host 'sudo tcpdump -i any -w -' | wireshark -k -i -
Newer
Older
ssh user@remote-host 'sudo tcpdump -i any -w -' | wireshark -k -i -