How to sniff interface on remote machine with Wireshark from Mac OS?

Execute following commands on Mac OSX console.

Create fifo:

mkfifo /tmp/remote

Run wireshark:

wireshark -k -i /tmp/remote

And run tcpdump to this fifo over ssh:

ssh root@10.0.xxx.xxx  "tcpdump -s 0 -U -n -w - -i eth1 -S" > /tmp/remote

Works nice!

Source: http://serverfault.com/questions/362529/how-can-i-sniff-the-traffic-of-remote-machine-with-wireshark