3

Im trying to use wireshark in my test enironment where I have two VM's with ip address 192.168.0.1 and 192.168.0.2

Im trying to monitor the data of the machine 192.168.0.2 from the machine at 192.168.0.1 using wireshark with tcpdump I got to know from the Tutorial Here.

Now, I made the pipe using the command

mkfifo /tmp/pipes/cap_fwd

It was created but when I try to do the second step that is ssh to the machine to run tcpdump and redirect its output to the pipe it doesn't work as the SSH doesn't gets completed the cursor keeps on blinking and doesn't gets executed. See the image below.

Blinking cursor

P.S. When I try to get the output of tcpdump on a normal file it does it easily so I believe the pipe is not working here. Please Help.

EDIT 1

1.I have checked the permission of the pipe and set it to full permissions for now.

2.I have created the pipe on my machine at ip 192.168.0.1 do I have to configure anything at the machine on 192.168.0.2

EDIT 2

Comment on the tutorial website by one of the user I'm having the same problem.

i tried to run it on my openwrt box, from ubuntu 10.10, but when i execute the command ssh root@192.168.1.1 -p 443 “tcpdump -i eth0 -s 0 -U -w – not port 443″ > /tmp/pipes/cap_fw nothing happens (it should ask me the pw i suppose, but it doesn’t), it acts like if i didn’t press Return… the dropbear daemon is running on port 443 with pw login (no certificate)

Also he added later

it was only a problem of not using certificates with ssh, now it works correctly thanks!

Is this really the case of not using certificates as I too am not using any certificates for ssh.

4

The output of ssh root@192.168.0.2 "tcpdump -s 0 -U -n -w - -i eth0 > /tmp/pipies/cap_fw command is redirected to the named pipe (/tmp/pipies/cap_fw). Thus, you will not see absolutely nothing in terminal when the process begin. So, it's a normal behavior.

Therefore, let like this the current open terminal to send signals to the pipe and open a new terminal or a new tab in terminal and go to the step 3 from your tutorial. When you will start wireshark -k -i /tmp/pipes/cap_fw in second (tab) terminal, you will be asked for password in first (tab) terminal. So, enter your password to continue.

Look also at the image from your tutorial to understand better.

See also: Using Named Pipes (FIFOs) with Bash

| improve this answer | |
  • I just went back to the tutorial and found a comment which matches my situation. Maybe now I will make my problem clearer. I am adding it with my question. – Tarun Aug 24 '13 at 11:12
  • @Tarun I also edited my answer – Radu Rădeanu Aug 24 '13 at 11:16
  • Hey its working now, thanks so much for the help. Though its a strange behavior and took some time to get it going but its working finally like you said. :) – Tarun Aug 24 '13 at 11:23
  • 1
    @Tarun Yes, it's a strange behavior as long as you don't understand clear how these named pipes works. It's happened to me also. – Radu Rădeanu Aug 24 '13 at 11:27
  • Ya. I believe I will have to look at the concept of named pipes in more details. But its a good concept of wireshark where network analysis can be done remotely. – Tarun Aug 24 '13 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.