update readme for better clarity on usage instructions

README.md

@@ -0,0 +1,79 @@
+# Remote Interface Packet Capture
+
+Stream packets from a Remote VM directly into Wireshark on your Local Machine.
+
+### **1. Prerequisites (Local Machine)**
+
+First, ensure you have the necessary tools installed on your **local computer**.
+
+```bash
+sudo apt update
+sudo apt install wireshark
+```
+
+### **2. Prepare the Pipe (Local Machine)**
+
+Create a FIFO (First-In, First-Out) pipe file on your **local machine**. This acts as a bridge to feed data from SSH into Wireshark.
+
+> [!NOTE]
+> Do not give this file an extension like `.pcap`. Just a plain name is best.
+
+```bash
+mkfifo /tmp/remote_capture
+```
+
+### **3. Start Wireshark (Local Machine)**
+
+Open a terminal on your **local machine** and start Wireshark. It will wait for data to arrive in the pipe you just created.
+
+```bash
+wireshark -k -i /tmp/remote_capture
+```
+
+- `-k`: Start capturing immediately.
+- `-i`: Specify the input interface (our pipe file).
+
+### **4. Start the Data Stream (Local Machine)**
+
+Open a **new terminal window** on your **local machine**. Run one of the following commands to connect to the VM and start piping traffic.
+
+**Option A: Standard Capture (Best for most cases)**
+Use this if you have SSH key access (passwordless) or can type the password interactively.
+
+```bash
+ssh <user>@<remote_ip> "sudo tcpdump -s 0 -U -n -w - -i <interface_name> not port 22" > /tmp/remote_capture
+```
+
+**Option B: If you need to filter multiple ports**
+Use this to exclude specific noise (like the SSH port 22 and perhaps a web port 80).
+
+```bash
+ssh <user>@<remote_ip> "sudo tcpdump -s 0 -U -n -w - -i <interface_name> not port 22 and not port 80" > /tmp/remote_capture
+```
+
+**Option C: If the remote user requires a SUDO password non-interactively**
+Use this _only_ if you must automate the sudo password entry (less secure, but sometimes necessary).
+
+```bash
+ssh <user>@<remote_ip> "echo '<password>' | sudo -S tcpdump -s 0 -U -n -w - -i <interface_name> not port 22" > /tmp/remote_capture
+```
+
+#### tcpdump & SSH Command Reference
+
+| Flag / Component        | Description                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------- |
+| `-s 0`                  | Capture the full packet (don't truncate)                                        |
+| `-U`                    | Packet-buffered mode (sends packets immediately, doesn't wait to fill a buffer) |
+| `-n`                    | Don't resolve DNS names (faster)                                                |
+| `-w -`                  | Write the output to `stdout` (standard output) instead                          |
+| `-i <interface_name>`   | The network interface on the **VM** you want to sniff (e.g., `eth0`)            |
+| `not port 22`           | Crucial. This filters out your own SSH traffic                                  |
+| `> /tmp/remote_capture` | Redirects the output from the SSH session into your local pipe file             |
+
+### **Cleanup (When Finished)**
+
+When you are done, close Wireshark and the terminal running SSH. Then remove the pipe file on your **local machine**:
+
+```bash
+rm /tmp/remote_capture
+```