In today's Linux systems, tcpdump is readily available, and therefore, is frequently used to capture packets. Although tcpdump can be used to dump packet flows and even content, the supported "capture filter" is sometimes not as convenient as Wireshark. Support engineers often need to copy the PCAP file locally to launch the Wireshark GUI and do packet filtering and inspection.
This article demonstrates how to use the tshark tool on the Linux server to locate packets of interest and inspect these packets directly. Note: The test in this example is conducted on a compute node in a lab Contrail setup.
Capturing and dumping packets on a tap interface
On a tap interface, there is no MPLS over GRE or UDP encapsulation. Therefore, tcpdump is sufficient to locate the ICMPv6 packets:
root@test:~# tcpdump -ni tap55ec3c7f-91 ip6 tcpdump: WARNING: tap55ec3c7f-91: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tap55ec3c7f-91, link-type EN10MB (Ethernet), capture size 65535 bytes 21:41:23.577019 IP6 2001::3 > 2002::3: ICMP6, echo request, seq 0, length 64 21:41:23.579510 IP6 2002::3 > 2001::3: ICMP6, echo reply, seq 0, length 64
Capturing packets on a fabric interface
On a fabric interface, all packets coming from or going to a Virtual Machine (VM) will be encapsulated in MPLS over UDP or GRE header, which makes it hard to locate the packets with tcpdump .
tcpdump
3.242852766 2001::3 -> 2002::3 ICMPv6 194 Echo (ping) request id=0x5b01, seq=0, hop limit=64 3.244930240 2002::3 -> 2001::3 ICMPv6 150 Echo (ping) reply id=0x5b01, seq=0, hop limit=64 (request in 66)
However, tshark supports a more extensive display filter ( "-Y " flag ) so it can locate the packet more easily.
"-Y
The -d udp.port flag instructs wireshark to interpret packets with the UDP port "51234" and the decode as MPLS label . Therefore, the encapsulated content (ICMPv6) can be recognized.
-d udp.port
decode
as
By using the above tshark command with the -V option , the packet content can be dumped and decoded as follows:
tshark
-V
root@test:~# tshark -ni eth1 -Y "ip.addr==172.222.19.198 and ip.addr==172.222.19.199 and icmpv6" -d udp.port==51234,mpls Running as user "root" and group "root". This could be dangerous. Capturing on 'eth1'
### Echo Request
Frame 56: 150 bytes on wire (1200 bits), 150 bytes captured (1200 bits) on interface 0 Interface id: 0 (eth1) Interface name: eth1 Encapsulation type: Ethernet (1) Arrival Time: Jan 29, 2018 21:41:23.577468980 PST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1517290883.577468980 seconds [Time delta from previous captured frame: 0.000315453 seconds] [Time delta from previous displayed frame: 0.000433191 seconds] [Time since reference or first frame: 4.060101381 seconds] Frame Number: 56 Frame Length: 150 bytes (1200 bits) Capture Length: 150 bytes (1200 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:mpls:ipv6:icmpv6:data] Ethernet II, Src: 00:50:56:88:fd:ce, Dst: 00:50:56:88:c6:6e Destination: 00:50:56:88:c6:6e Address: 00:50:56:88:c6:6e .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 00:50:56:88:fd:ce Address: 00:50:56:88:fd:ce .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 172.222.19.198, Dst: 172.222.19.199 #<-tunnelling IP 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 136 Identification: 0x6633 (26163) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0x92e8 [validation disabled] [Header checksum status: Unverified] Source: 172.222.19.198 Destination: 172.222.19.199 [Source GeoIP: United States, United States] [Source GeoIP Country: United States] [Source GeoIP Country: United States] [Destination GeoIP: United States, United States] [Destination GeoIP Country: United States] [Destination GeoIP Country: United States] User Datagram Protocol, Src Port: 60482, Dst Port: 51234 Source Port: 60482 Destination Port: 51234 Length: 116 [Checksum: [missing]] [Checksum Status: Not present] [Stream index: 6] MultiProtocol Label Switching Header, Label: 46, Exp: 0, S: 1, TTL: 64 0000 0000 0000 0010 1110 .... .... .... = MPLS Label: 46 .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0 .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1 .... .... .... .... .... .... 0100 0000 = MPLS TTL: 64 Internet Protocol Version 6, Src: 2001::3, Dst: 2002::3 #<---mirrored IP 0110 .... = Version: 6 .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) .... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000 Payload Length: 64 Next Header: ICMPv6 (58) Hop Limit: 64 Source: 2001::3 Destination: 2002::3 [Destination 6to4 Gateway IPv4: 0.0.0.0] [Destination 6to4 SLA ID: 0] [Source Teredo Server IPv4: 0.0.0.0] [Source Teredo Port: 65535] [Source Teredo Client IPv4: 255.255.255.252] [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Internet Control Message Protocol v6 Type: Echo (ping) request (128) Code: 0 Checksum: 0xea2d [correct] [Checksum Status: Good] Identifier: 0x7a01 Sequence: 0 Data (56 bytes) 0000 ac a9 2e a3 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 ........ Data: aca92ea30000000000000000000000000000000000000000... [Length: 56]
### Echo Reply
Frame 66: 150 bytes on wire (1200 bits), 150 bytes captured (1200 bits) on interface 0 Interface id: 0 (eth1) Interface name: eth1 Encapsulation type: Ethernet (1) Arrival Time: Jan 29, 2018 21:41:23.579456779 PST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1517290883.579456779 seconds [Time delta from previous captured frame: 0.000498030 seconds] [Time delta from previous displayed frame: 0.001987799 seconds] [Time since reference or first frame: 4.062089180 seconds] Frame Number: 66 Frame Length: 150 bytes (1200 bits) Capture Length: 150 bytes (1200 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:mpls:ipv6:icmpv6:data] Ethernet II, Src: 00:50:56:88:c6:6e, Dst: 00:50:56:88:fd:ce Destination: 00:50:56:88:fd:ce Address: 00:50:56:88:fd:ce .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 00:50:56:88:c6:6e Address: 00:50:56:88:c6:6e .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 172.222.19.199, Dst: 172.222.19.198 #<------tunneling 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 136 Identification: 0x1b02 (6914) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xde19 [validation disabled] [Header checksum status: Unverified] Source: 172.222.19.199 Destination: 172.222.19.198 [Source GeoIP: United States, United States] [Source GeoIP Country: United States] [Source GeoIP Country: United States] [Destination GeoIP: United States, United States] [Destination GeoIP Country: United States] [Destination GeoIP Country: United States] User Datagram Protocol, Src Port: 63494, Dst Port: 51234 Source Port: 63494 Destination Port: 51234 Length: 116 [Checksum: [missing]] [Checksum Status: Not present] [Stream index: 10] MultiProtocol Label Switching Header, Label: 24, Exp: 0, S: 1, TTL: 64 0000 0000 0000 0001 1000 .... .... .... = MPLS Label: 24 .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0 .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1 .... .... .... .... .... .... 0100 0000 = MPLS TTL: 64 Internet Protocol Version 6, Src: 2002::3, Dst: 2001::3 #<------mirrored IP 0110 .... = Version: 6 .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) .... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000 Payload Length: 64 Next Header: ICMPv6 (58) Hop Limit: 64 Source: 2002::3 Destination: 2001::3 [Source 6to4 Gateway IPv4: 0.0.0.0] [Source 6to4 SLA ID: 0] [Destination Teredo Server IPv4: 0.0.0.0] [Destination Teredo Port: 65535] [Destination Teredo Client IPv4: 255.255.255.252] [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Internet Control Message Protocol v6 Type: Echo (ping) reply (129) Code: 0 Checksum: 0xe92d [correct] [Checksum Status: Good] Identifier: 0x7a01 Sequence: 0 [Response To: 56] [Response Time: 1.988 ms] Data (56 bytes) 0000 ac a9 2e a3 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 ........ Data: aca92ea30000000000000000000000000000000000000000... [Length: 56]
2022-03-12: Added more info on tshark.