Wireshark Packet Capture in CML 2 / VIRL 2

My first post in a while…

I recently started using Cisco Modeling Labs Personal / VIRL 2 and noticed it had no Wireshark packet capture function, or a way to download pcap files. However, captures can be performed!

This can be done using Netcat to stream the capture over the network. This example is on a Mac.

First, we start a capture in our CML Personal Lab. This is done by selecting the link and navigating to the Packet Capture tab.

I set the Max Packets value to something high, so the capture doesn’t end before I have time to set things up. I then click start.

In Terminal, run the following command:

nc -l 20000 | wireshark -ki -

This starts the Netcat process listening on port 20000. It pipes the output into Wireshark. The ‘-k’ option tells Wireshark to start capturing instantly and the ‘-i -‘ option tells Wireshark to capture from stdin. I think.

Now, on the CML Personal server log in to the Cockpit (https://<server ip>:9090) and go to the Terminal tab.

Run the following command:

sudo tail -f /var/tmp/*.pcapng -n +1 | nc <Capture System IP> 20000

Captures are stores in /var/tmp. They’re deleted once the capture ends. This command assumes only a single capture is running. You could use the specific filename if multiple captures are running. The tail -f command watches the file for updates and continually pipes data to Netcat. The ‘-n +1’ option ensures that the whole file is piped from the beginning by instructing the tail -f command to start at line 1. Netcat pipes the output to the Capture system on port 20000.

Packets will now begin to stream into Wireshark…

It’s all a bit awkward, so it will be really nice once Cisco create this functionality via the GUI.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.