My first post in a while…
I recently started using Cisco Modeling Labs Personal / VIRL 2 and noticed it had no Wireshark packet capture function, or a way to download pcap files. However, captures can be performed!
This can be done using Netcat to stream the capture over the network. This example is on a Mac.
First, we start a capture in our CML Personal Lab. This is done by selecting the link and navigating to the Packet Capture tab.
I set the Max Packets value to something high, so the capture doesn’t end before I have time to set things up. I then click start.
In Terminal, run the following command:
nc -l 20000 | wireshark -ki -
This starts the Netcat process listening on port 20000. It pipes the output into Wireshark. The ‘-k’ option tells Wireshark to start capturing instantly and the ‘-i -‘ option tells Wireshark to capture from stdin. I think.
Now, on the CML Personal server log in to the Cockpit (https://<server ip>:9090) and go to the Terminal tab.
Run the following command:
sudo tail -f /var/tmp/*.pcapng -n +1 | nc <Capture System IP> 20000
Captures are stores in /var/tmp. They’re deleted once the capture ends. This command assumes only a single capture is running. You could use the specific filename if multiple captures are running. The tail -f command watches the file for updates and continually pipes data to Netcat. The ‘-n +1’ option ensures that the whole file is piped from the beginning by instructing the tail -f command to start at line 1. Netcat pipes the output to the Capture system on port 20000.
Packets will now begin to stream into Wireshark…
It’s all a bit awkward, so it will be really nice once Cisco create this functionality via the GUI.