path: root/users/wpcarro/website/blog/posts/tcp-tunneling-note.md

## Background

Let's say we'd like to debug a remote machine but use some of the debugging
tools we have on our local machine like wireshark.

You *can* run `tcpdump` on the remote and then `scp` the file to your local
machine to analyze the traffic, but after doing that a few times you may want a
workflow with a tighter feedback loop. For this we'll forward traffic from a
remote machine to our local machine.

**Note:** There's also `termshark`, which is a `wireshark` TUI that you can run
on the remote. It's quite cool!

## Local

Run the following on your local machine to forward your remote's traffic:

```shell
λ ssh -R 4317:127.0.0.1:4317 -N -f user@remote
```

Here is an abridged explanation of the flags we're passing from `man ssh`:

```
-N     Do  not  execute  a remote command.  This is useful for just forwarding ports.
-f     Requests ssh to go to background just before command execution.
```

**Note:** I couldn't find a good explanation for the `-R` option, so I tried
removing it and re-running the command, but that results in a resolution error:

```
ssh: Could not resolve hostname 4317:127.0.0.1:4317: Name or service not known
```

The remote should now be forwarding traffic from port `4317` to our
machine.

## Testing

Let's generate some traffic on the remote:

```shell
λ telnet localhost 4317
Trying ::1...
Connected to localhost.
Escape character is '^]'.
hello
world
```

Locally you should see:

```shell
λ nc -l 4317 -k # run this *before* running the above command
hello
world
```

You should now be able to `tcpdump -i lo port 4317` or just use `wireshark`
locally.

Happy debugging!