I want to monitor traffic on an interface on a remote machine and can't see the best way to do that. I have wireshark on my opensuse box and want to monitor traffic on the wlan0 wireless interface on a headless pi. I started by putting wireshark on the pi and remoting its interface via ssh-X to the opensuse box, but that gives me strange options in the capture window (ciscodump et al). Whenever I google I get confused about which end is 'remote' and which end is 'local'. I also tried installing tcpdump on the pi and got that to display in the opensuse xterm I'm running ssh to the pi in. But I don't understand how to connect that to wireshark. So what's best? Should I be running wireshark on the pi but displayed on the opensuse box, and if so how do I get it to show me the pi's interfaces? Or should I be running wireshark on the opensuse box and if so how do I get it to show me the pi's interfaces?