tshark could be used for realtime remote packet analysis via ssh tunnel. tcpdump does not.