Home / ubuntu / Questions / 336566
Accepted
Tarun
Asked: 2013-08-25 00:57:14 +0800 CST

pipe not working for wireshark

  • 772

Im trying to use wireshark in my test enironment where I have two VM's with ip address 192.168.0.1 and 192.168.0.2

Im trying to monitor the data of the machine 192.168.0.2 from the machine at 192.168.0.1 using wireshark with tcpdump I got to know from the Tutorial Here.

Now, I made the pipe using the command 

mkfifo /tmp/pipes/cap_fwd

It was created but when I try to do the second step that is ssh to the machine to run tcpdump and redirect its output to the pipe it doesn't work as the SSH doesn't gets completed the cursor keeps on blinking and doesn't gets executed. See the image below.

Blinking cursor

P.S. When I try to get the output of tcpdump on a normal file it does it easily so I believe the pipe is not working here. Please Help.

EDIT 1

1.I have checked the permission of the pipe and set it to full permissions for now.

2.I have created the pipe on my machine at ip 192.168.0.1 do I have to configure anything at the machine on 192.168.0.2

EDIT 2

Comment on the tutorial website by one of the user I'm having the same problem.

i tried to run it on my openwrt box, from ubuntu 10.10, but when i execute the command ssh [email protected] -p 443 “tcpdump -i eth0 -s 0 -U -w – not port 443″ > /tmp/pipes/cap_fw nothing happens (it should ask me the pw i suppose, but it doesn’t), it acts like if i didn’t press Return… the dropbear daemon is running on port 443 with pw login (no certificate)

Also he added later

it was only a problem of not using certificates with ssh, now it works correctly thanks!

Is this really the case of not using certificates as I too am not using any certificates for ssh.

12.04

1 Answers

  1. Best Answer

    The output of ssh [email protected] "tcpdump -s 0 -U -n -w - -i eth0 > /tmp/pipies/cap_fw command is redirected to the named pipe (/tmp/pipies/cap_fw). Thus, you will not see absolutely nothing in terminal when the process begin. So, it's a normal behavior.

    Therefore, let like this the current open terminal to send signals to the pipe and open a new terminal or a new tab in terminal and go to the step 3 from your tutorial. When you will start wireshark -k -i /tmp/pipes/cap_fw in second (tab) terminal, you will be asked for password in first (tab) terminal. So, enter your password to continue.

    Look also at the image from your tutorial to understand better.

    See also: Using Named Pipes (FIFOs) with Bash

    • 4