Running Wireshark captures from F5 BIG-IP
My colleague, Simon Kowallik, recently posted something really cool to our internal message boards. It started with the question:
“Have you ever wanted to run captures with Wireshark on BIG-IP?”
Answer: Yes, for like twelve years I wanted to do this!
In the post below, Simon shows us how to use the packet tracing tool Wireshark (or any other tool that reads pcaps from tcpdump) directly with BIG-IP using only some slight of hand.
Anyway, I thought this was so awesome that it deserved wider audience so here it is, republished with Simon’s permission. Have fun!
Posted by Simon Kowallik in on Jul 7, 2013 9:02:38 AM
We actually can do that without installing X, wireshark and hundreds of libraries on BIG-IP. Which is not an option anyway. 🙂
There are a few things we need:
- SSH access to the BIG-IP, bash or tmsh is fine
- Proper SSH client on our Desktop, eg. OpenSSH or alternatives (putty & plink)
The trick is to launch an ssh session without a login shell and run tcpdump through it on the remote system making tcpdump write raw packets to STDOUT while piping it to our local wireshark reading from STDIN.
Here are two examples:
cygwin on Windows
# ssh -l root 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" |
/cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -k -i -
Linux
# ssh -l root 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" |
/usr/bin/wireshark -k -i -
Windows CMD with plink (download from putty homepage):
plink.exe -l root -pw default 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" |
"c:\Program Files\Wireshark\wireshark.exe" -k -i -
I think you can figure out how it works. If not, here are a few hints:
- Tcpdump's option -w with - as an argument writes to STDOUT instead of a file
- Wireshark's -i option reads from an interface, - as an argument makes STDIN the interface.
- STDIN/STDOUT is represented by - on most platforms.
Caveats
Tcpdump does buffer the output when writing to a file (our STDOUT in our case), which unfortunately means it might take some time until we can see the traffic in wireshark. Tcpdump offers options to influence the buffering however this is not implemented in our version of Libpcap (tested on 11.4HF1).
This is especially annoying if we want to capture low volume traffic. What we could do is capturing icmp echo requests+replies additionally to the traffic we are interested in, and remove them again with the wireshark display filter. Then start a ping to push the interesting packets to wireshark faster.
Words of warning
You are piping the whole packet capture through ssh, so make sure you define your tcpdump filter reasonable, otherwise bad things might happen.
- CG1Nimbostratus
Guys, you may also find this link helpful
https://gitlab.com/wireshark/wireshark/-/issues/17888#note_2028273626
- JRahmAdminsweetness!
- LyonsG_85618CirrostratusAwesom....very useful solution.
- Chris_FPCirrusIt works like a dream with the full installed version of WireShark but I was unable to get it to work with WireShark Portable. Not sure what the differences are, be nice to know what I'd need to do to fix it so it does.
- LEON_LI_38034NimbostratusCOOL!!!!!
- netvis_66639NimbostratusGreat article. In cases where you don't yet know what tcpdump filter you want to apply, you can use the sFlow packet sampling capability in 11.4 with Wireshark to get an overview that will help select sensible filters:
- Don_Flinspach_1Historic F5 AccountWhile the buffering option (-U, for the curious) that David mentions as not being supported by F5’s supplied version of libpcap, the -l flag (line buffering) certainly seems to be. This seems to show all but the last line captured, so the output is a little more immediate. YMMV, of course, but this was tested in 11.4.0 and 11.4.1.
- Simon_Kowallik1Historic F5 Account@Chris: For wireshark portable look for the real wireshark.exe. The WiresharkPortable.exe is just a wrapper which is invoking the real one.
- Brian_Mayer_841NimbostratusAwesome article, saves me a step when doing my packet captures! Thank you so much, Simon/David.
- dtooke_164654NimbostratusNice. I like the idea, still trying to get it to work though.