wireshark

How to capture all network traffic of a single process 1

 in GNU/Linux  tagged forward / gateway / ip link / ip netns / isolated network / NAT / network namespace / strace / VXLAN / wireshark by

Method A: Using strace

If the process is not started yet, you can start it as a new process and monitor it using the following


strace -f -e trace=network -s 10000 <PROCESS WITH ARGUMENTS>;

If the process is already started and you know its PID you can use the following


strace -f -e trace=network -s 10000 -p <PID>;

strace is a very helpful utility that can be used to trace system calls and signals.

Parameters Legend:

  • -f Instructs strace to trace all child processes as they are created by the currently traced processes as a result of the fork, vfork and clone system calls.
    Note that -p PID -f will attach all threads of process PID if it is multi-threaded, not only thread with id PID.
  • -e trace=%network strace will trace all the network related system calls only if used alone.
  • -s strsize Specifies the maximum string size to print (the default is 32). Note that filenames are not considered strings and are always printed in full.
  • -p PID Attaches strace to the process with the process ID PID and starts tracing. The trace may be terminated at any time by a keyboard interrupt signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running. Multiple -p options can be used to attach to many processes in addition to command (which is optional if at least one -p option is given). -p "`pidof APPLICATION`" syntax is supported.

In the simplest case strace runs the specified command until it exits. It intercepts and records the system calls which are called by a process and the signals which are received by a process. The name of each system call, its arguments and its return value are printed on standard error or to the file specified with the -o option.
strace is a useful diagnostic, instructional, and debugging tool. System administrators, diagnosticians and trouble-shooters will find it invaluable for solving problems with programs for which the source is not readily available since they do not need to be recompiled in order to trace them. Students, hackers and the overly-curious will find that a great deal can be learned about a system and its system calls by tracing even ordinary programs. And programmers will find that since system calls and signals are events that happen at the user/kernel inter‐ face, a close examination of this boundary is very useful for bug isolation, sanity checking and attempting to capture race conditions.

From: man strace

Method B: Using an isolated network namespace and Wireshark

Please note that this method might not work for all kernels.
It was tested on Fedora 25 (64 bit) with success.

Create the test network namespace

A network namespace is logically another copy of the network stack, with its own routes, firewall rules, and network devices.
With the following command we will create a network namespace called test.


sudo ip netns add test;

ip netns add NAME Creates a new named network namespace.
If NAME is available in /var/run/netns/ this command creates a new network namespace and assigns to it then name NAME.

Create two virtual network interfaces (veth0 and veth1) for our Virtual eXtended LAN (VXLAN)

The following command will create veth0 and veth1 virtual network interfaces.


sudo ip link add veth0 type veth peer name veth1;

ip link add with no link argument specified to a physical device to operate on, it adds a VXLAN virtual link.
Note: veth1 will act as a gateway later on.

Change the active namespace of the veth0 interface

With the following command, we move veth0 to our test network namespace.


sudo ip link set veth0 netns test;

Some devices are not allowed to change network namespace: loopback, bridge, ppp, wireless. These are network namespace local devices. In such case ip tool will return Invalid argument error. It is possible to find out if device is local to a single network namespace by checking netns-local flag in the output of the ethtool:
ethtool -k DEVICE;
To change network namespace for wireless devices the iw tool can be used. But it allows to change network namespace only for physical devices and by process PID.
From man ip-link

Configure the IP addresses of the virtual interfaces


#Set the IP of veth0 to 192.168.10.1 and veth0 to 192.168.10.254
sudo ip netns exec test ifconfig veth0 up 192.168.10.1 netmask 255.255.255.0;
sudo ifconfig veth1 up 192.168.10.254 netmask 255.255.255.0;

Configure the routing in the test namespace

The following command will set the default gateway for veth0 to be the IP 192.168.10.254 which is the address we gave veth1 in the previous step.


sudo ip netns exec test route add default gw 192.168.10.254 dev veth0;

Then we make sure ip_forward is active by issuing the following command


sudo sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward';

Then, we establish a NAT rule to forward all the traffic of test network namespace to a physical device


sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o <PHYSICAL DEVICE e.g. eth0> -j SNAT --to-source <PHYSICAL DEVICE IP>;

Actually using the isolated network namespace

Add root to the list of users that is allowed to start an X application


xhost +si:localuser:root;

Start wireshark in your test network namespace


sudo ip netns exec test wireshark &

In wireshark start monitoring the data on the device veth0.

Finally, start the application you wish to monitor its network traffic


sudo ip netns exec test firefox;

Compiling Wireshark 1.8.8 on Fedora 25 (64bit)

 in GNU/Linux  tagged 1.8.15 / 1.8.8 / 1.8.x / compile / fedora / wireshark by

Recently we received some dissector plugins for Wireshark version 1.8.x, which is not available to install through the repositories.
So, we had to install it ourselves and we decided to use version 1.8.8 that was the latest version of the 1.8.x series available in the following FedoraProject.org page.
The source code is available at https://www.wireshark.org/download/src/all-versions/ and http://pkgs.fedoraproject.org/repo/pkgs/wireshark/.

Download the patched version here: [download id=”3443″]

Synopsis

While configuring we run into a few problems, that we solved by installing the following packages:


sudo dnf install perl-podlators perl-Pod-Html gtk2-devel gtk3-devel libpcap-devel byacc flex -y;

When compiling we run into an error where an a wireshark enum was conflicting with a system one.
To resolve that issue we modified the file: epan/dissectors/packet-gluster.h and at line 357 we removed the next enum:

/* dir-entry types from libglusterfs/src/compat.h */
enum gluster_entry_types {
    DT_UNKNOWN = 0,
    DT_FIFO = 1,
    DT_CHR = 2,
    DT_DIR = 4,
    DT_BLK = 6,
    DT_REG = 8,
    DT_LNK = 10,
    DT_SOCK = 12,
    DT_WHT = 14
};

It is safe to delete it as it exists in the exact same form and same values in the system header files.
Please note that in version 1.8.15 we found the following enum, which shows that it was decided later on to just change the enum fields.

/* dir-entry types from libglusterfs/src/compat.h */
enum gluster_entry_types {
    GLUSTER_DT_UNKNOWN = 0,
    GLUSTER_DT_FIFO = 1,
    GLUSTER_DT_CHR = 2,
    GLUSTER_DT_DIR = 4,
    GLUSTER_DT_BLK = 6,
    GLUSTER_DT_REG = 8,
    GLUSTER_DT_LNK = 10,
    GLUSTER_DT_SOCK = 12,
    GLUSTER_DT_WHT = 14
};

Later during compilation we got the error that there was an undefined reference to g_memmove, we copied the definition of g_memmove (see below) from  packaging/macosx/native-gtk/glibconfig.h at line 81 and pasted it on the first line of the files ui/gtk/export_object_smb.c and epan/dissectors/packet-ssl-utils.c.

#define g_memmove(dest,src,len) G_STMT_START { memmove ((dest), (src), (len)); } G_STMT_END

Finally during documentation generation we had a problem with two authors that there were Non-ASCII characters in their names so we updated the file AUTHORS and replaced the names Peter Kovář  with Peter Kovar and Роман Донченко with Roman Donchenko which are strings that only contain ASCII characters.

Download the patched version here: [download id=”3443″]

The Problems One by One

checking for pod2man... /usr/bin/pod2man
checking for pod2html... no
configure: error: I couldn't find pod2html; make sure it's installed and in your path

Solution: sudo dnf install perl-podlators perl-Pod-Html;

checking for GTK+ - version >= 2.12.0 and < 3.0... Package gtk+-2.0 was not found in the pkg-config search path.
Perhaps you should add the directory containing `gtk+-2.0.pc'
to the PKG_CONFIG_PATH environment variable
No package 'gtk+-2.0' found
no
*** Could not run GTK+ test program, checking why...
*** The test program failed to compile or link. See the file config.log for the
*** exact error that occured. This usually means GTK+ is incorrectly installed.
configure: error: Neither Qt nor GTK+ 2.12 or later are available, so Wireshark can't be compiled

Solution: sudo dnf install gtk2-devel gtk3-devel;

checking for pcap-config... no
checking for extraneous pcap header directories... not found
checking pcap.h usability... no
checking pcap.h presence... no
checking for pcap.h... no
configure: error: Header file pcap.h not found; if you installed libpcap
from source, did you also do "make install-incl", and if you installed a
binary package of libpcap, is there also a developer's package of libpcap,
and did you also install that package?

Solution: sudo dnf install libpcap-devel;

libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I../.. -I./../.. -I./.. -DINET6 -DG_DISABLE_DEPRECATED -DG_DISABLE_SINGLE_INCLUDES -DGSEAL_ENABLE -DGTK_DISABLE_DEPRECATED -DGTK_DISABLE_SINGLE_INCLUDES -D_FORTIFY_SOURCE=2 "-D_U_=__attribute__((unused))" -I/usr/local/include -DPLUGIN_DIR=\"/usr/local/lib/wireshark/plugins/1.8.8\" -g -O2 -Wall -W -Wextra -Wdeclaration-after-statement -Wendif-labels -Wpointer-arith -Wno-pointer-sign -Warray-bounds -Wcast-align -Wformat-security -Wold-style-definition -Wno-error=unused-but-set-variable -fexcess-precision=fast -pthread -I/usr/include/gtk-2.0 -I/usr/lib64/gtk-2.0/include -I/usr/include/pango-1.0 -I/usr/include/atk-1.0 -I/usr/include/cairo -I/usr/include/pixman-1 -I/usr/include/libdrm -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/libpng16 -I/usr/include/pango-1.0 -I/usr/include/harfbuzz -I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/freetype2 -I/usr/include/libpng16 -I/usr/include/freetype2 -I/usr/include/libpng16 -MT libdissectors_la-packet-gluster_cli.lo -MD -MP -MF .deps/libdissectors_la-packet-gluster_cli.Tpo -c packet-gluster_cli.c  -fPIC -DPIC -o .libs/libdissectors_la-packet-gluster_cli.o
In file included from /usr/include/glib-2.0/glib/gdir.h:32:0,
                 from /usr/include/glib-2.0/glib.h:45,
                 from packet-gluster_cli.c:40:
packet-gluster.h:359:2: error: redeclaration of enumerator 'DT_UNKNOWN'
  DT_UNKNOWN = 0,
  ^
/usr/include/dirent.h:99:5: note: previous definition of 'DT_UNKNOWN' was here
     DT_UNKNOWN = 0,
     ^~~~~~~~~~
packet-gluster.h:360:2: error: redeclaration of enumerator 'DT_FIFO'
  DT_FIFO = 1,
  ^
/usr/include/dirent.h:101:5: note: previous definition of 'DT_FIFO' was here
     DT_FIFO = 1,
     ^~~~~~~
packet-gluster.h:361:2: error: redeclaration of enumerator 'DT_CHR'
  DT_CHR = 2,
  ^
/usr/include/dirent.h:103:5: note: previous definition of 'DT_CHR' was here
     DT_CHR = 2,
     ^~~~~~
packet-gluster.h:362:2: error: redeclaration of enumerator 'DT_DIR'
  DT_DIR = 4,
  ^
/usr/include/dirent.h:105:5: note: previous definition of 'DT_DIR' was here
     DT_DIR = 4,
     ^~~~~~
packet-gluster.h:363:2: error: redeclaration of enumerator 'DT_BLK'
  DT_BLK = 6,
  ^
/usr/include/dirent.h:107:5: note: previous definition of 'DT_BLK' was here
     DT_BLK = 6,
     ^~~~~~
packet-gluster.h:364:2: error: redeclaration of enumerator 'DT_REG'
  DT_REG = 8,
  ^
/usr/include/dirent.h:109:5: note: previous definition of 'DT_REG' was here
     DT_REG = 8,
     ^~~~~~
packet-gluster.h:365:2: error: redeclaration of enumerator 'DT_LNK'
  DT_LNK = 10,
  ^
/usr/include/dirent.h:111:5: note: previous definition of 'DT_LNK' was here
     DT_LNK = 10,
     ^~~~~~
packet-gluster.h:366:2: error: redeclaration of enumerator 'DT_SOCK'
  DT_SOCK = 12,
  ^
/usr/include/dirent.h:113:5: note: previous definition of 'DT_SOCK' was here
     DT_SOCK = 12,
     ^~~~~~~
packet-gluster.h:367:2: error: redeclaration of enumerator 'DT_WHT'
  DT_WHT = 14
  ^
/usr/include/dirent.h:115:5: note: previous definition of 'DT_WHT' was here
     DT_WHT = 14
     ^~~~~~
Makefile:6516: recipe for target 'libdissectors_la-packet-gluster_cli.lo' failed
make[5]: *** [libdissectors_la-packet-gluster_cli.lo] Error 1

Solution: edit epan/dissectors/packet-gluster.h and at line 357 delete this

/* dir-entry types from libglusterfs/src/compat.h */
enum gluster_entry_types {
    DT_UNKNOWN = 0,
    DT_FIFO = 1,
    DT_CHR = 2,
    DT_DIR = 4,
    DT_BLK = 6,
    DT_REG = 8,
    DT_LNK = 10,
    DT_SOCK = 12,
    DT_WHT = 14
};

libtool: link: gcc -DPYTHON_DIR= -g -O2 -Wall -W -Wextra -Wdeclaration-after-statement -Wendif-labels -Wpointer-arith -Wno-pointer-sign -Warray-bounds -Wcast-align -Wformat-security -Wold-style-definition -Wno-error=unused-but-set-variable -fexcess-precision=fast -pthread -I/usr/include/gtk-2.0 -I/usr/lib64/gtk-2.0/include -I/usr/include/pango-1.0 -I/usr/include/atk-1.0 -I/usr/include/cairo -I/usr/include/pixman-1 -I/usr/include/libdrm -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/libpng16 -I/usr/include/pango-1.0 -I/usr/include/harfbuzz -I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/freetype2 -I/usr/include/libpng16 -I/usr/include/freetype2 -I/usr/include/libpng16 -Wl,--as-needed -o .libs/wireshark wireshark-capture-pcap-util-unix.o wireshark-capture-pcap-util.o wireshark-cfile.o wireshark-clopts_common.o wireshark-disabled_protos.o wireshark-frame_data_sequence.o wireshark-packet-range.o wireshark-print.o wireshark-ps.o wireshark-sync_pipe_write.o wireshark-timestats.o wireshark-tap-megaco-common.o wireshark-tap-rtp-common.o wireshark-version_info.o wireshark-capture_ifinfo.o wireshark-capture_sync.o wireshark-capture_ui_utils.o wireshark-airpcap_loader.o wireshark-capture.o wireshark-capture_info.o wireshark-capture_opts.o wireshark-color_filters.o wireshark-file.o wireshark-fileset.o wireshark-filters.o wireshark-g711.o wireshark-merge.o wireshark-proto_hier_stats.o wireshark-recent.o wireshark-summary.o wireshark-tempfile.o wireshark-u3.o .libs/wiresharkS.o -pthread -Wl,--export-dynamic -pthread -Wl,--export-dynamic  -L/usr/local/lib ui/gtk/libgtkui.a ui/gtk/libgtkui_dirty.a ui/libui.a codecs/libcodec.a wiretap/.libs/libwiretap.so epan/.libs/libwireshark.so wsutil/.libs/libwsutil.so -lpcap -lkrb5 -lk5crypto -lcom_err -lgtk-x11-2.0 -lgdk-x11-2.0 -lpangocairo-1.0 -latk-1.0 -lcairo -lgdk_pixbuf-2.0 -lgio-2.0 -lpangoft2-1.0 -lpango-1.0 -lgobject-2.0 -lfontconfig -lfreetype -lgthread-2.0 -lgmodule-2.0 -lglib-2.0 -lm -lz -pthread -Wl,-rpath -Wl,/usr/local/lib
ui/gtk/libgtkui.a(libgtkui_a-export_object_smb.o): In function `insert_chunk':
/home/george/Downloads/wireshark-1.8.8/ui/gtk/export_object_smb.c:230: undefined reference to `g_memmove'
collect2: error: ld returned 1 exit status

Solution: Copy the definition of g_memmove (see below) from  packaging/macosx/native-gtk/glibconfig.h at line 81 and paste it on the first line of the files ui/gtk/export_object_smb.c and epan/dissectors/packet-ssl-utils.c.

#define g_memmove(dest,src,len) G_STMT_START { memmove ((dest), (src), (len)); } G_STMT_END

Making all in doc
make[2]: Entering directory '/home/george/Downloads/wireshark-1.8.8/doc'
/usr/bin/perl ./perlnoutf.pl ./make-authors-short.pl < ../AUTHORS > AUTHORS-SHORT
cp AUTHORS-SHORT ..
/usr/bin/perl ./perlnoutf.pl ./make-authors-format.pl < AUTHORS-SHORT > AUTHORS-SHORT-FORMAT
cat ./wireshark.pod.template AUTHORS-SHORT-FORMAT > wireshark.pod
/usr/bin/pod2man                    \
--center="The Wireshark Network Analyzer"    \
--release=1.8.8                \
wireshark.pod  > wireshark.1
Wide character in printf at /usr/share/perl5/vendor_perl/Pod/Simple.pm line 565.
wireshark.pod around line 3527: Non-ASCII character seen before =encoding in 'KovE<aacute>ř'. Assuming UTF-8
POD document had syntax errors at /usr/bin/pod2man line 71.

and

cat ./wireshark.pod.template AUTHORS-SHORT-FORMAT > wireshark.pod
/usr/bin/pod2man                    \
--center="The Wireshark Network Analyzer"    \
--release=1.8.8                \
wireshark.pod  > wireshark.1
Wide character in printf at /usr/share/perl5/vendor_perl/Pod/Simple.pm line 565.
wireshark.pod around line 3618: Non-ASCII character seen before =encoding in 'Роман'. Assuming UTF-8
POD document had syntax errors at /usr/bin/pod2man line 71.

Solution: update the file AUTHORS and replace the names the names Peter Kovář  with Peter Kovar and Роман Донченко with Roman Donchenko which are strings that only contain ASCII characters.

Download the patched version here: [download id=”3443″]

VirtualBox: Failed to attach the USB device to the virtual machine 29

 in Windows  tagged dirvers / regedit / usb / usbpcap / virtualbox / wireshark by

Recently we were using a Windows 10 64bit machine which had Oracle VirtualBox installed.
At some point all USB devices stopped mounting on the guest systems.
We would get errors similar to the following:

Failed to attach the USB device OnePlus A0001 [0232] to the virtual machine Ubuntu.

USB device 'OnePlus A0001' with UUID {544e5582-9e77-4301-a538-5326cf2250c0} is busy with a previous request. Please try again later.

Result Code: E_INVALIDARG (0x80070057)
Component: HostUSBDeviceWrap
Interface: IHostUSBDevice {c19073dd-cc7b-431b-98b2-951fda8eab89}

Callee: IConsole {872da645-4a9b-1727-bee2-5585105b9eed}

USB device  with UUID  is busy with a previous request. Please try again later.

After a couple of restarts of both the guest and the host machines we realized that this time, a restart was not enough to fix the error.
Right before this error occurred, we had installed Wireshark with USBPcap support.
Apparently this was the root of our problem.

Resolution:

Following are the steps we followed to solve this issue:

Step A: Delete problematic system configuration.

Press the key combination Win + R to pop up the Run prompt.
Type regedit in the input box and hit the Enter key.

regedit

On the left side of the new window, navigate to the following location:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}

upperfilters

In the right part, select the UpperFilters entry, right click it and select Delete.

delete-upperfilters
When a prompt window appear asks you to confirm that you want to delete the value, click Yes.

confirm-delete-upperfilters

Step B: Manually re-install VirtualBox USB drivers (Optional)

Just in case there is an issue with the VirtualBox USB drivers, you can re-install them to be sure everything is OK.
To do that, you can either re-install the whole VirtualBox using their installer or manually re-install the driver itself.

To re-install the VirtualBox USB driver manually, using Windows Explore navigate to this folder

C:\Program Files\Oracle\VirtualBox\drivers\USB\filter

Right click the file VBoxUSBMon.inf and select Install.

install-virtualbox-usb-driver
You will get a confirmation once the installation is complete.
Restart your machine, so that new changes will get applied.
Your USB devices should work as expected.