2012, Oracle. All rights reserved. Slide 1

Transcription

1 2012, Oracle. All rights reserved. Slide 1

2 <Insert Picture Here> Stupid Wireshark Tricks Chuck Lever Consulting Member of Technical Staff

3 General Comments Stability Wireshark crashes Dissectors use heuristics, get confused Missing features for us Parts of NFSv4.1 and pnfs FedFS ADMIN Implementation-specific decoders for client IDs, state IDs, file handles, etc. When in doubt, try wireshark before tshark Enormous flexibility and rich feature set The GUI can guide you through esoteric features 2012, Oracle. All rights reserved. Slide 3

4 <Insert Picture Here> Filter Types 2012 Oracle. All rights reserved. Slide 4

5 Capture Filters Same as tcpdump filters man pcap-filter(7) on Linux Set before capturing Course-grained, but useful for reducing volume of captured data Examples tcp dst port <nnnn> host <aa.bb.cc.dd> 2012, Oracle. All rights reserved. Slide 5

6 Display Filters Specific to wireshark man wireshark-filter(4) on Linux Can be changed while capturing, or while displaying previously captured frames Finer-grained than capture filters Examples tcp.port == <nnnn> ip.addr == <aa.bb.cc.dd> (nfs) && (rpc.programversion == 4) 2012, Oracle. All rights reserved. Slide 6

7 <Insert Picture Here> Snoop Idioms 2012 Oracle. All rights reserved. Slide 7

8 Snoop Idioms Capture any traffic involving <host> $ snoop <host> is equivalent to: $ tshark host <host> 2012, Oracle. All rights reserved. Slide 8

9 Snoop Idioms Capture traffic between <host1> and <host2> $ snoop <host1> <host2> is equivalent to: $ tshark host <host1> && host <host2> 2012, Oracle. All rights reserved. Slide 9

10 Snoop Idioms Capture all packets from port <nn> on host <host> $ snoop <host> from port <nn> is equivalent to: $ tshark host <host> && port <nn> 2012, Oracle. All rights reserved. Slide 10

11 Snoop Idioms Display packets containing NFS payload $ snoop rpc nfs is equivalent to: $ tshark -R nfs 2012, Oracle. All rights reserved. Slide 11

12 Snoop Idioms Read from <capture_file> rather than reading live traffic $ snoop -i <capture_file> is equivalent to: $ tshark -r <capture_file> 2012, Oracle. All rights reserved. Slide 12

13 Snoop Idioms Write raw packets to <capture_file> $ snoop -o <capture_file> is equivalent to: $ tshark -w <capture_file> 2012, Oracle. All rights reserved. Slide 13

14 Snoop Idioms Display frames <fr1> through <fr2> $ snoop -i <capture_file> \ -p <fr1>,<fr2> is equivalent to: $ tshark -r <capture_file> \ -R (frame.number >= <fr1>) && \ (frame.number <= <fr2>) 2012, Oracle. All rights reserved. Slide 14

15 Snoop idioms Display details of only frame <fr> $ snoop -i <capture_file> -p <fr> -v is equivalent to: $ tshark -r <capture_file> -V \ -R frame.number == <fr> 2012, Oracle. All rights reserved. Slide 15

16 Snoop idioms Read from network interface <intf> instead of the default $ snoop -d <intf> is equivalent to: $ tshark -i <intf> Capture traffic on all interfaces: $ tshark -i any 2012, Oracle. All rights reserved. Slide 16

17 Snoop idioms Capture only the first 200 bytes of each frame $ snoop -s 200 -o <capture_file> is equivalent to: $ tshark -s 200 -w <capture_file> 2012, Oracle. All rights reserved. Slide 17

18 Snoop Idioms Display frames with absolute time $ snoop -t a is equivalent to: $ tshark -t a 2012, Oracle. All rights reserved. Slide 18

19 Snoop Idioms Disable reverse-mapping IP and MAC addresses $ snoop -r is equivalent to: $ tshark -n 2012, Oracle. All rights reserved. Slide 19

20 <Insert Picture Here> Extended Features 2012 Oracle. All rights reserved. Slide 20

21 Reducing Capture Volume Capture autostop -a duration:<seconds> -a filesize:<kilobytes> -a files:<count> Capture ring buffer -b duration:<seconds> -b filesize:<kilobytes> -b files:<count> Capture packet count -c <count> 2012, Oracle. All rights reserved. Slide 21

22 Reducing Capture Volume Disable promiscuous mode -p Decrease snaplen -s 200 NB: IPoIB can generate frames larger than , Oracle. All rights reserved. Slide 22

23 Fine-tuning tshark s Output -V - very verbose -d - decode as Example: -d tcp.port==xxxx,http -z - statistics Example: -q -z rpc,programs 2012, Oracle. All rights reserved. Slide 23

24 Fine-tuning tshark s output -T - set output format pdml - detailed output in XML format psml - summary output in XML format ps - PostScript text - default text on standard output fields - comma-separated fields (used with -e) -e field1 -e field2 -e... Examples: frame.number, ip.addr, nfs.read.data_length -G fields generates glossary of field names 2012, Oracle. All rights reserved. Slide 24

25 For More Information , Oracle. All rights reserved. Slide 25

26 <Insert Picture Here> Wireshark Demonstration 2012 Oracle. All rights reserved. Slide 26

27 2012, Oracle. All rights reserved. Slide 27