visualização de pacotes capturados (e filtrados) remotamente com o tcpdump através de uma ligação segura por ssh no wireshark numa máquina local

ssh lxc_web3 '/usr/sbin/tcpdump -K -U -n -w - -ni eth1 -s 65535 not port 22 and not port 443 and not port 53 and not icmp and not port 80 and not arp and not stp and not port 137 and not igmp and not ip6 and not port 138 and not port 587 and not udp and host 10.116.102.11' | wireshark -k -i -

instalar core network no debian stretch x86 (provavemente também no jessie)

x86 | como root:
apt-get update
wget https://downloads.pf.itd.nrl.navy.mil/core/packages/4.8/core-gui_4.8-0ubuntu1_trusty_all.deb
wget https://downloads.pf.itd.nrl.navy.mil/core/packages/4.8/core-daemon_4.8-0ubuntu1_trusty_i386.deb
dpkg -i core-gui_4.8-0ubuntu1_trusty_all.deb core-daemon_4.8-0ubuntu1_trusty_i386.deb
apt-get install -f

redirecionar consultas dns

iptables -t nat -A PREROUTING -i ethX -p udp --dport 53 -j DNAT --to $(get lan_ipaddr)
iptables -t nat -A PREROUTING -i ethX -p tcp --dport 53 -j DNAT --to $(get lan_ipaddr)
iptables -t nat -L -v -n # shows nat table

melhor:
iptables -t nat -A PREROUTING -s 10.0.100.0/24 -p udp --dport 53 -j DNAT --to 9.9.9.9:53
iptables -t nat -A PREROUTING -s 10.0.100.0/24 -p tcp --dport 53 -j DNAT --to 9.9.9.9:53

Subscrever network