Re: Unable to libvirt wireshark dissector

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 03/27/2018 08:41 AM, Han Han wrote:
> Hi guys,
> I am trying to analyze libvirt rpc protocol by wireshark. But I found
> wireshark doesn't dissect libvirt packets. Here are my environments
> operations:
> 
> 1. Environments:
> My system: Debian GNU/Linux buster/sid with *kernel-4.15.0-1-amd64*
> Packages installed:
> 
> 
> *libvirt0-4.1.0-2-amd64 libvirt-wireshark-4.1.0-2-amd64
> wireshark-2.4.5-1-amd64*
> 2. Libvirt configurations
> */etc/libvirt/libvirtd.conf*:
> 
> 
> 
> *listen_tls = 0listen_tcp = 1tcp_port = "16509"auth_tcp = "none"*
> 
> Libvirtd started with options
> 
> 
> *--listen*
> 3. Check wireshark libvirt plugin:
> Open menu: *Help* --> *About* *wireshark* --> *Plugins*. Libvirt plugin is
> found:
> *libvirt.so 4.1.0 dissector
> /usr/lib/x86_64-linux-gnu/w…rk/plugins/2.4.5/libvirt.so*
> 
> 
> 4. Set wireshark listening on *lo* interface and filter as
> 'tcp.port==16509'. Execute virsh command via tcp protocol:
> $ virsh -c qemu+tcp://localhost/system list
> 
> In wireshark, packets are parsed as TCP protocol. And I cannot find Libvirt
> protocol in 'Decode as..' protocols list. And libvirt protocol is also not
> found in *Edit* --> *Preference* --> *Protocols*.
> 
> So it seems libvirt packets are not dissected as libvirt protocol in
> wireshark. How can I use the wireshark libvirt plugin?

This is weird. It's working for me. Looks like your libvirt plugin is
not loaded. If you build the wireshark plugin from libvirt.git and then
copy it to "~/.config/wireshark/plugins/libvirt.so" does it help?

Michal

_______________________________________________
libvirt-users mailing list
libvirt-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvirt-users




[Index of Archives]     [Virt Tools]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]

  Powered by Linux