Daily Archives: 30 November 2017

How to process tcpdump live data stream from a remote machine on a local WireShark 1

 in Applications  tagged execute over ssh / local / mkfifo / named pipe / pipe / pipe over ssh / remote / ssh / tcpdump / wireshark by

Recently we needed to process the results of a tcpdump command using the GUI version of WireShark on machine that did not have a window manager installed. That device was an embedded device, for which it did not make sense to even consider installing a window manager on it. So, in order to process the results of the tcpdump command we decided to use another machine that had a full working window manager installed and was able to operate the GUI version of WireShark.

For our solution to work some requirements were expected to be met by the embedded device (a.k.a. remote machine).

  1. tcpdump was installed on the remote machine
  2. ssh server was installed on the remote machine and allowed us to connect to it remotely
  3. there was a user that had remote ssh rights on the remote machine that also had the rights to execute tcpdump on the needed interfaces

Synopsis of our solution:

Just execute the following on the machine with the GUI (a.k.a. local machine)


mkfifo /tmp/board;
wireshark -k -i /tmp/board &
ssh [email protected] "tcpdump -s 0 -U -n -w - -i lo not port 22" > /tmp/board;

Explanation of our solution:

Following are the steps that we performed on the local machine to pipe the results of tcpdump on the remote machine on the wireshark on the local machine.

  1. First we created a named pipe as follows:
    mkfifo /tmp/board;
    You can name your pipe anyway you like and place it in any folder you wish. We used /tmp as our pipe is a temporary construct that we do not care to preserve across time/restarts.
  2. Then we started wireshark from a terminal so that we could pass as capture interface the named pipe we just created using the -i /tmp/board parameter. The -k parameter instructs wireshark to start the capture session immediately.
    wireshark -k -i /tmp/board &
    Since this operation was going to execute for a long time, we sent it to the background to release the terminal for further use by placing the & symbol at the end of the command.
  3. Finally, we started tcpdump over ssh on a board and redirected its output to our named pipe.
    ssh [email protected] "tcpdump -s 0 -U -n -w - -i lo not port 22" > /tmp/board;
    The parameters we used on tcpdump have the following effects:
    -s 0 instructs tcpdump to set the snapshot length of data from each packet to the default value of 262144 bytes.
    -U Since the -w option is not specified, make the printed packet output packet-buffered. Which means that it will print the description of the contents of each packet without waiting for the output buffer to get full.
    -n Does not convert host addresses to names. This can be used to avoid DNS lookups.
    -w - Write the raw packets to Standard Output rather than parsing them.
    -i lo Defines which interface to listen on. We wanted the loopback interface to listen to everything.
    not port 22 Since we used ssh to start this command, we do not want to listen to the data that we produce as well and flood the inputs.

 

Enable C++11 standard for GCC on Eclipse CDT

 in Applications  tagged -std=c++11 / C++ / C++11 / CDT / compiler / eclipse / eclipse CDT / gcc / GCC C++ Compiler / standard by

When using Eclipse CDT to write C++, we noticed that it did not enable by default the C++11 standard. Following the steps below, we added the -std=c++11 flag on the GCC C++ Compiler command line arguments enabling the standard for our use.

  1. From the main window of Eclipse, on the list on the left, where your projects are listed, right click on your project and then click Properties from the new menu
  2. In the new window, navigate from the list on the left and expand the C/C++ Build option to view its children and then click the Settings item
  3. In the middle of the window, you will see a new list, expand (if needed) the item GCC C++ Compiler and click on the Miscellaneous child
  4. On the right, a text box named Other Flags will appear, append -std=c++11 to the list of tokens in the box as seen in the image below
  5. Click on the Apply button for the effects to take place and then the OK button to close the properties window

Next time you compile, the -std=c++11 flag will be present on your compiler command line and the C++11 standard will be used.