Adam Carter writes:
> Wireshark has an X11 decoder. For tcpdump you could try -vv or -vvv but
> i would just go straight to wireshark it will almost certainly be more
> useful. Of course if its inside an ssh tunnel you will only see ssh
> with a packet sniffer. If you're on the local box sniff lo0.
Thanks! I think this will help me with my problem.
I had to start a 2nd X server to test this, though. Nowadays, X starts
with '-nolisten tcp' option, and so there is no communication over port
6000. But when I started another X server manually, and changed the
DISPLAY variable from ':1' to 'localhost:1', I saw the X traffic on port
6001.
Thanks again,
Wonko
