it is possible to do a live packet capure on a remote linux machine and process it live in wireshark on a windows machine. you need to have wireshark and plink (comes with putty) installed. To get a remote packet capture from a linux computer to a windows machine running wireshark: plink user@host -batch -P 222 "sudo tshark -i eth1 -w - " | "c:\Program Files\Wireshark\Wireshark.exe" -k -i - plink: windows executable that create’s an ssh link user@host: ssh user and host -batch: no questions asked -P: used port sudo tshark -i eth1 -w - : with sudo execute tshark on the remote server, listening on interface eth0 and -w write the output to stdout pipe the output of the remote ssh command to wireshark -i -: use stdin as input for wireshark

Fieuw, after a few hours of searching and testen i’ve got it working! Cacti can now shows disk io of our windows 2008 servers! Here is how i did it: wmi-client libwmiclient1 download them and install at http://www.orvant.com/packages/(go to bottom) cacti wmi plugin, download the wmi.phpand put it in your cacti/scripts/ folder. Make sure the webserver you are running can read the file! http://svn.parkingdenied.com/CactiWMI/trunk/ cacti wmi templates