[Phillip Heller <pheller@xxxxxx>]

Hello,

  I'm attempting to do a remote capture as follows:

mkfifo /tmp/pipe
ssh -t host "sudo tshark -w - not port 22" >> /tmp/pipe

Then, I fire up Wireshark [Version 1.1.2 (SVN Rev 27060), running on  
Mac OS 10.5.6 linked against native GTK Quartz libraries.  Point it  
at /tmp/pipe and start capture, at which point the ssh process prompts  
me for my password and I'm immediately told "Unrecognized libpcap  
format".

I can cat the pipe and get the very same data I get running tshark  
locally.

Any ideas?

--phil