How to Monitor SSH port forwarded traffic

I have a box which people may use to proxy their web traffic through
using SSH dynamic port forwarding (ssh -D). Is there a way that I can
monitor/capture just that traffic, to exclude other traffic passing over
that interface?

A wrote:
> I have a box which people may use to proxy their web traffic through
> using SSH dynamic port forwarding (ssh -D). Is there a way that I can
> monitor/capture just that traffic, to exclude other traffic passing over
> that interface?
(apologies if this message appeared 3 times. My browser kept reporting
that sending failed so I kept trying, then I noticed it showed up in
google groups. I have attempted to cancel the extra messages.)

On 10/18/2006 06:33 AM, A wrote:
> A wrote:
>> I have a box which people may use to proxy their web traffic through
>> using SSH dynamic port forwarding (ssh -D). Is there a way that I can
>> monitor/capture just that traffic, to exclude other traffic passing over
>> that interface?
> (apologies if this message appeared 3 times. My browser kept reporting
> that sending failed so I kept trying, then I noticed it showed up in
> google groups. I have attempted to cancel the extra messages.)

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b2)
Gecko/20060823 SeaMonkey/1.1a

You have been posting all these from a Linux machine, why don't you
learn to user some real new-reader; try thunderbird, tin, slrn, pan,
knode, xnews and, or trn in addition to mozilla/seamonkey mail. The
slrnpull and, or leafnode can help you work offline.

--
Dr Balwinder S "bsd" Dheeman Registered Linux User: #229709
Anu's Linux@HOME Machines: #168573, 170593, 259192
Chandigarh, UT, 160062, India Distros: Ubuntu, Fedora, Knoppix
Home: http://cto.homelinux.net/~bsd/ Visit: http://counter.li.org/

A <A@a.a> wrote:
> I have a box which people may use to proxy their web traffic through
> using SSH dynamic port forwarding (ssh -D). Is there a way that I can
> monitor/capture just that traffic, to exclude other traffic passing over
> that interface?

Well, you know what port you've assigned to -D so you can listen to it.
Is this what you're after?

ssh -D 1080 -n -N some.remote.host # Maybe also -f or -v
tshark -pi any port 1080 # Or tethereal

The ssh -v option will let you see what ssh is doing. The tshark/tethereal
command dumps the network traffic, and since it sees it's on the SOCKS
port 1080 it applies SOCKS protocol translation to the traffic for you.

Chris