Sniffers in VSX environments

[Matlu]

Hello.

Is it possible to apply a TCPDUMP or CPPCAP on a particular vsenv, and “export” the result in a pcap file?

Now, if it is possible to do this, how would you get the pcap file?

Would I have to connect by WinSCP (for example), to my VS0. or can I connect by WinSCP directly to a particular vsenv, to be able to extract the pcap file and be able to review it?

Thanks for your comments.

[Bob_Zimmerman · Accepted solution]

You can start a capture in a particular VS in a few ways:

vsenv 5
tcpdump ...

# Or from any VS:

ip netns exec CTX00005 tcpdump ...

The "CTX00005" is the name of the VS. It's the VSID padded with leading zeros to be five digits. VS 123 would be CTX00123. You can see all of them by running 'ip netns list'.

As for getting the capture file later, VSs are just network namespaces. They have separate routing tables and firewall policies, but that's it. It's all one server running one OS with one filesystem. They're much less isolated than virtual machines, for example.

[Matlu]

So, is it possible to run a tcpdump or cppcap from VS0 itself but ‘focused’ on a particular vsenv, and save the result in a pcap?

For example I have the need to run a capture from my vsenv 2, with source 192.168.20.100 and destination 10.100.20.10 by icmp service.

Could you show me the example of the syntax of the command, being 'stopped' in the VS0?

Thank you.

[Lesley]

cppcap -o capturenam.pcap -v 2 -f " host 192.168.20.100 and host 10.100.20.10 "

[the_rock]

Bro,

I literally built VSX lab this morning just to CONFIRM this, since you asked about it in the other sxl post, haha. And yes, what @Bob_Zimmerman said is exactly right.

Andy

[the_rock]

Check out the site my colleague made ages ago, has bunch of different options for major fw vendors when doing common captures.

Andy

https://tcpdump101.com/#