And tcpdump already exists on every server. I frequently pipe the output of tcpdump over ssh into wireshark for analysis on my local machine.

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -