See also
- Gentoo wiki on Wireshark: https://wiki.gentoo.org/wiki/Wireshark. I’m only really adding some notes on it on what I had to do.
Troubleshooting libssh errors
When using sshdump, if you get errors about invalid / unknown SSH config directives, make sure you’re not running Wireshark as root. See the “Permissions” section on the Gentoo wiki:
$ sudo gpasswd -a <username> pcap
$ newgrp pcap
$ groups
then run Wireshark as the non-root user.
Privilege on the remote end
Make sure the “elevate privileges on the remote end” is set as needed. For SSHing into
root, this should be “None”!