Network recording for error finding - Revision history

Camille at 12:45, 23 June 2023

2023-06-23T12:45:20Z

Camille: /* Wireshark */

2023-06-01T10:03:50Z

Wireshark

Marcel at 13:05, 23 September 2021

2021-09-23T13:05:04Z

Marcel at 13:04, 23 September 2021

2021-09-23T13:04:35Z

Camille at 08:37, 4 August 2021

2021-08-04T08:37:58Z

Camille: Created

2021-08-04T08:23:14Z

Created

New page

Sometimes, you can have occasional network errors, like stream disconnecting, without having a clue of why.

A good help is to record the network exchanges continuously, so you can get back the network capture afterwards to analyze it.

This can be done by using [https://www.wireshark.org/ Wireshark], or its command-line version [https://www.tcpdump.org/ tcpdump] under Linux or Windows.

=== Wireshark ===
To use Wireshark, you need to have a user logged in and a graphical desktop interface.

# Launch Wireshark
# Go into Capture->Options
# In the Input Tab:
## Select the network interface
## Optionally set a [https://www.tcpdump.org/manpages/pcap-filter.7.html filter]
### To select conversation with one host IP, set in the capture filter : <code>host 192.168.1.12</code>
### To select only TCP protocol set <code>tcp</code> or to select udp set <code>udp</code>
### To select only conversation for one port set <code>port 80</code>
### To select only TCP push packets <code>(tcp and (tcp[tcpflags] & (tcp-push) != 0)</code>
### You can combine all those with <code>and</code>, <code>or</code>, <code>not</code> and use parenthesis <code>(</code> <code>)</code>.
### Example: to get all HTTP traffic with 173.236.178.205: <code>host 173.236.178.205 and port 80 and (tcp and (tcp[tcpflags] & (tcp-push) != 0))</code>
# Go to the Output Tab and
## Select a base file name for storage
## Select pcapng format
## Check "Create a new file automatically"
## Check "When time is a multiple of" and choose for instance 15 minutes.
## Check "Use a ring buffer with" and select enough files to cover the time you need from detection to handling. To cover 24 hours with 15 minutes files, you need 24*4=96 files.
# Go to the Options Tab:
## Uncheck "Update list of packets in real-time" to avoid memory increasing too much if you let it run for days

Depending on what you record and how big the traffic is, you should select a proper time range for each file.

When you detect a problem, you can then go to the storage folder of files, and copy the one with match the time when the problem happened, so it will not be deleted in next ring buffer.

=== Tcpdump ===
This works exactly as Wireshark, but in command-line, so you can run it in a Linux [https://linux.die.net/man/1/screen screen] virtual TTY or a with <code>nohup tcpdump ... &</code>.

For instance:

<code>tcpdump -i en0 -w /var/tmp/capture-%m-%d-%H-%M-%S-%s.pcapng -W 96 -G 900 "host 192.168.1.12 and tcp and port 80"</code>

will capture from interface <code>en0</code> filtering all HTTP traffic with <code>192.168.1.2</code>, and save it to files in <code>/var/tmp/capture-....pcapng</code> (filling the name with date/time) every <code>900</code> seconds (so 15 minutes), and limited to <code>96</code> files (so 1 day = 24*4).

Manual can be found [https://www.tcpdump.org/manpages/tcpdump.1.html here].

=== Standalone ===
You do not have access to the OS in the Standalone processors, but you can use a switch [[wikipedia:Port_mirroring|port mirroring]] to record all conversation.

# Configure the switch to mirror the port of the Standalone processor you want to monitor
# Connect your recording PC to the mirroring port
# Use Wireshark or Tcpdump to record the traffic.

@@ Line 35: / Line 35: @@
 '''<u>Note :</u>''' Wireshark needs special privileges to capture Ethernet packets. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges
-==== Multicast on Windows: ====
+====Multicast on Windows:====
 You need an external program to join the multicast. You may use [http://www.dqnetworks.ie/toolsinfo/mcasttest/ mcasttest].
@@ Line 60: / Line 60: @@
 #Use Wireshark or Tcpdump to record the traffic.
 [[Category:Troubleshoot]]

← Older revision		Revision as of 10:03, 1 June 2023
Line 34:		Line 34:

	'''<u>Note :</u>''' Wireshark needs special privileges to capture Ethernet packets. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges		'''<u>Note :</u>''' Wireshark needs special privileges to capture Ethernet packets. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges
		+
		+	==== Multicast on Windows: ====
		+	You need an external program to join the multicast. You may use [http://www.dqnetworks.ie/toolsinfo/mcasttest/ mcasttest].
		+
		+	If you need to select a specific interface, you need to add a route : <code>route add -p 239.192.13.1 mask 255.255.255.255 192.168.5.27 metric 3 if 14</code>
		+
		+	Use <code>route print</code> to find if number from MAC address.

	===Tcpdump===		===Tcpdump===

← Older revision		Revision as of 13:05, 23 September 2021
Line 33:		Line 33:


−	'''<u>Note :</u>''' Wireshark needs special ~~rights~~ to capture ~~ethernet~~. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges	+	'''<u>Note :</u>''' Wireshark needs special privileges to capture Ethernet packets. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

	===Tcpdump===		===Tcpdump===

← Older revision		Revision as of 13:04, 23 September 2021
Line 31:		Line 31:

	When you detect a problem, you can then go to the storage folder of files, and copy the one with match the time when the problem happened, so it will not be deleted in next ring buffer.		When you detect a problem, you can then go to the storage folder of files, and copy the one with match the time when the problem happened, so it will not be deleted in next ring buffer.
		+
		+
		+	'''<u>Note :</u>''' Wireshark needs special rights to capture ethernet. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

	===Tcpdump===		===Tcpdump===

@@ Line 5: / Line 5: @@
 This can be done by using [https://www.wireshark.org/ Wireshark], or its command-line version [https://www.tcpdump.org/ tcpdump] under Linux or Windows.
-=== Wireshark ===
+===Wireshark===
 To use Wireshark, you need to have a user logged in and a graphical desktop interface.
-# Launch Wireshark
+#Launch Wireshark
-# Go into Capture->Options
+#Go into Capture->Options
-# In the Input Tab:
+#In the Input Tab:
-## Select the network interface
+##Select the network interface
-## Optionally set a [https://www.tcpdump.org/manpages/pcap-filter.7.html filter]
+##Optionally set a [https://www.tcpdump.org/manpages/pcap-filter.7.html filter]
-### To select conversation with one host IP, set in the capture filter : <code>host 192.168.1.12</code>
+###To select conversation with one host IP, set in the capture filter : <code>host 192.168.1.12</code>
-### To select only TCP protocol set <code>tcp</code> or to select udp set <code>udp</code>
+###To select only TCP protocol set <code>tcp</code> or to select udp set <code>udp</code>
-### To select only conversation for one port set <code>port 80</code>
+###To select only conversation for one port set <code>port 80</code>
-### To select only TCP push packets <code>(tcp and (tcp[tcpflags] & (tcp-push) != 0)</code>
+###To select only TCP push packets <code>(tcp and (tcp[tcpflags] & (tcp-push) != 0)</code>
-### You can combine all those with <code>and</code>, <code>or</code>, <code>not</code> and use parenthesis <code>(</code> <code>)</code>.
+###You can combine all those with <code>and</code>, <code>or</code>, <code>not</code> and use parenthesis <code>(</code> <code>)</code>.
-### Example: to get all HTTP traffic with 173.236.178.205: <code>host 173.236.178.205 and port 80 and (tcp and (tcp[tcpflags] & (tcp-push) != 0))</code>
+###Example: to get all HTTP traffic with 173.236.178.205: <code>host 173.236.178.205 and port 80 and (tcp and (tcp[tcpflags] & (tcp-push) != 0))</code>
-# Go to the Output Tab and
+#Go to the Output Tab and
-## Select a base file name for storage
+##Select a base file name for storage
-## Select pcapng format
+##Select pcapng format
-## Check "Create a new file automatically"
+##Check "Create a new file automatically"
-## Check "When time is a multiple of" and choose for instance 15 minutes.
+##Check "When time is a multiple of" and choose for instance 15 minutes.
-## Check "Use a ring buffer with" and select enough files to cover the time you need from detection to handling. To cover 24 hours with 15 minutes files, you need 24*4=96 files.
+##Check "Use a ring buffer with" and select enough files to cover the time you need from detection to handling. To cover 24 hours with 15 minutes files, you need 24*4=96 files.
-# Go to the Options Tab:
+#Go to the Options Tab:
-## Uncheck "Update list of packets in real-time" to avoid memory increasing too much if you let it run for days
+##Uncheck "Update list of packets in real-time" to avoid memory increasing too much if you let it run for days
 Depending on what you record and how big the traffic is, you should select a proper time range for each file.
@@ Line 32: / Line 32: @@
 When you detect a problem, you can then go to the storage folder of files, and copy the one with match the time when the problem happened, so it will not be deleted in next ring buffer.
-=== Tcpdump ===
+===Tcpdump===
 This works exactly as Wireshark, but in command-line, so you can run it in a Linux [https://linux.die.net/man/1/screen screen] virtual TTY or a with <code>nohup tcpdump ... &</code>.
@@ Line 43: / Line 43: @@
 Manual can be found [https://www.tcpdump.org/manpages/tcpdump.1.html here].
-=== Standalone ===
+===Standalone===
 You do not have access to the OS in the Standalone processors, but you can use a switch [[wikipedia:Port_mirroring|port mirroring]] to record all conversation.
-# Configure the switch to mirror the port of the Standalone processor you want to monitor
+#Configure the switch to mirror the port of the Standalone processor you want to monitor
-# Connect your recording PC to the mirroring port
+#Connect your recording PC to the mirroring port
-# Use Wireshark or Tcpdump to record the traffic.
+#Use Wireshark or Tcpdump to record the traffic.