Wireshark

Guidelines

LEARN HOW TO FILTER, or be overwhelmed
You can't see url path or query params when using https, they are encrypted

Remote monitoring

It's not too hard to monitor another machine that may not have X on it.

First you have to TEMPORARILY allow [ssh root] on the exposed server, DO NOT LEAVE THIS ON:

ssh bitpost
emacs /etc/ssh/sshd_config # add root to AllowUsers

Then on the monitoring box, set up a shared pipe, use ssh to route a tcpdump, and capture it in wireshark.

ssh viper
sudo su -
mkfifo /tmp/bitpost_443 # make a shared pipe
wireshark -k -i /tmp/bitpost_443
ssh bitpost "tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/bitpost_443

CLEANUP

remove pipe

ssh viper && sudo rm /tmp/bitpost_443

FIX THE EXPOSED SERVER to disable [ssh root]:

ssh bitpost
emacs /etc/ssh/sshd_config # remove root from AllowUsers

Over X

Not sure a good idea...

   m@mbehrnsm-red:~$ ssh -Y jrh1
   ec2-user@ip-172-31-29-104:~$ sudo su -
   [root@ip-172-31-29-104 ~]# xauth add $(xauth -f ~ec2-user/.Xauthority list|tail -1)
   [root@ip-172-31-29-104 ~]# wireshark&