Comment by psophis

This is very cool. Though I’ve always done remote wireshark captures:

    ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i -

Source: https://serverfault.com/questions/362529/how-can-i-sniff-the...

It works very well on low volume captures.