Installing Wireshark On Linux for OpenFlow Packet Captures

[fancy_header3 variation=”orange”]Installing Wireshark On Linux for OpenFlow Packet Captures[/fancy_header3]

[warning_box]Update March 16, 2014:
Fedora 20 has native Wireshark OpenFlow support.
e.g:
yum install wireshark
[/warning_box]

[note_box]

• Update: the OpenFlow dissector appears natively included in the nightly Ubuntu dev builds and even better, native in Fedora 19:
• ### Fedora 19 Wireshark Installation ###
  1) sudo yum install wireshark
  2) Nothing! Its that easy w/ native OpenFlow support +1
  For an X session on Fedora over SSH perform the following.
  1) Install the following:
  sudo yum install xorg-x11-xauth
  sudo yum install xorg-x11-fonts-*
  sudo yum install xorg-x11-utils
  ======================
  2) Enable the following in the sshd_config file:
  =============================
  Change X11Forwarding to yes and uncomment:
  X11Forwarding yes
  ====== sshd_config ==========
  #AllowAgentForwarding yes
  #AllowTcpForwarding yes
  #GatewayPorts no
  #X11Forwarding no
  X11Forwarding yes <=== change this #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes =============== $ export (should contain) declare -x DISPLAY="localhost:10.0" ========================= Now you can "ssh -X 192.168.1.100" to your host and run an X Wireshark session using "sudo wireshark".

### Mac Installation ###
Wireshark 1.11.0-SVN-52202
http://www.wireshark.org/download/automated/

• For a Mac just install quartz and this build and run as su.
• sudo /Applications/Wireshark.app/Contents/MacOS/Wireshark

### Installing on Ubuntu using the PPA repo try the following ###

• sudo apt-get install python-software-properties
• sudo add-apt-repository ppa:mighost/ppa
• sudo apt-get update
• ### The following was pulled from 1.12.0~201309171613-1ppa1~precise in a dpkg –list. You likely don’t need to mess with repo preferences.###
• sudo apt-get install wireshark-common libwireshark3 libwireshark-data libwireshark3 libwiretap3
• sudo wireshark
• ### To run remotely you can connect using X over ssh with ‘ssh -XY

Link to the PPA Repo
[/note_box]

[image_frame style=”framed_shadow” align=”center” alt=”OpenFlow from Package PPA” width=”520″]http://networkstatic.net/wp-content/uploads/2013/10/Wireshark-OpenFlow.jpeg[/image_frame]

This tutorial is for those who are learning, troubleshooting and developing using the OpenFlow wire protocol. Packet captures are vital to troubleshooting issues that occur between the switch and OpenFlow controller. The instructions are for installing Wireshark from package or compiling and installing from source. It also walks through installing the OpenFlow v1.0 dissector plugin for Wireshark. Once the plugin is installed you will be able to view OpenFlow messaging in the Wireshark packet captures.

[fancy_header3 variation=”orange”]Installing Wireshark From Repositories[/fancy_header3]

[fancy_list style=”circle_arrow” variation=”orange”]

• Ubuntu Wireshark installation from Repository

[/fancy_list]

[fancy_list style=”circle_arrow” variation=”orange”]

• RedHat (CentOS/RHEL) Wireshark installation from Repository

[/fancy_list]

[fancy_header3 variation=”orange”]Download and Installing The OpenFlow Wireshark Dissector Option #1 [/fancy_header3]

This dissector is maintained by Nick Bastin. I am wedging it in here as I missed this one when I initially wrote this post. The other Stanford version is older but works fine for OpenFlow v1.0 but this is much more up to date. The video below is for the original version covered in option #2 below. Start with this one.

[fancy_list style=”circle_arrow” variation=”orange”]

• OpenFlow v1.0 dissector repo https://bitbucket.org/barnstorm/of-dissector
• OpenFlow v1.1+ dissector repo https://bitbucket.org/barnstorm/ng-of-dissector

[/fancy_list]

[fancy_header3 variation=”orange”]Download and Installing The OpenFlow Wireshark Dissector Option #2[/fancy_header3]

Before you go on you need to edit packet-openflow.c to fix a problem from a change in the Wireshark API.

Open the following C file in a text editor:

Add the following constant somewhere in the file with the other definitions. Look for “#define” and just add wedge it in there.

Next change find the function:
Change from:

To:

[image_frame style=”framed_shadow” align=”center” alt=”openflow.so” height=”64″ width=”455″]http://networkstatic.net/wp-content/uploads/2013/02/openflow.so_.jpg[/image_frame]
Figure 1. The void proto_reg_handoff_openflow() function after edit.

Copy the dynamic library or shared object (so file) packet-openflow.so into the Wireshark plugins directory.

[fancy_header3 variation=”orange”]Running Wireshark with the OpenFlow Dissector[/fancy_header3]

If you get the following error, verify you edited acket-openflow.c properly and recompile the dissector again to create another packet-openflow.so object file.

[fancy_header3 variation=”orange”]Verifying OpenFlow Dissector and Wireshark Installation[/fancy_header3]

In Wireshark go to Help->About->Plugins tab. You should see the OpenFlow plugin in the list.

[image_frame style=”framed_shadow” align=”center” alt=”OpenFlow Wireshark Dissector” height=”468″ width=”498″]http://networkstatic.net/wp-content/uploads/2013/02/about-plugin.jpg[/image_frame]

Figure 2. The OpenFlow Wireshark plugin

You can now view the OpenFlow header and packet type from your Wireshark captures. More information on generating OpenFlow packets can be found in these tutorials.

[image_frame style=”framed_shadow” align=”center” alt=”OpenFlow Wireshark Plugin” height=”500″ width=”555″]http://networkstatic.net/wp-content/uploads/2013/02/wireshark-openflow.jpg[/image_frame]

Figure 3. Viewing OpenFlow messages in Wireshark.

[fancy_header3 variation=”orange”]Video of Installing and Operating Wireshark with OpenFlow Captures[/fancy_header3]

[youtube url=”http://youtu.be/Uo1TN3nAxCg” width=”640″ height=”360″ hd=”1″]
Video 1. Screemcast of the Wireshark and OpenFlow plugin installation.

[fancy_header3 variation=”orange”]Compiling and Installing Wireshark from Source on Ubuntu and RHEL/CentOS[/fancy_header3]

[fancy_list style=”circle_arrow” variation=”orange”]

• Ubuntu

[/fancy_list]

[fancy_list style=”circle_arrow” variation=”orange”]

• RedHat (CentOS/RHEL) I didn’t verify the dependencies, but those should cover everything.

[/fancy_list]

Download the source code from http://wireshark.org

[fancy_header3 variation=”orange”]Additional Reseources[/fancy_header3]

[fancy_list style=”circle_arrow” variation=”orange”]

• OpenFlow Wireshark Dissector v1.0 – The dissector used in this tutorial.
• OpenFlow v1.1+ Wireshark Nick Bastin put together a dissector supporting OpenFlow v1.1+. This doesn’t support v1.0. So before you pull out your hair wondering why you see the protocol recognized but not dissected, be sure to use a dissector that is supporting your OF version. E.g. learn from my mistakes :*(
• My buddy Murphy McCauley has instructions for installing the dissector on a Mac over at Noxrepo.org.
• I would be remiss while on the topic of sharks, if I didn’t take the chance to link to a petition against shark hunting, being used as live bait and the horrible practice of “finning” The Petition Site.

[/fancy_list]

Thanks for stopping by.