Mac OS and packetflix URL

[hellt]

Hi all,
thanks for this great service, this looks like an amazing companion to Containerlab.

I was trying to make the Wireshark plugin to work with Edgeshark UI on mac os.
I am successfully using the Edgeshark UI, but I think some installation step is missing for Mac OS installation when it comes to the csharg plugin.

I copied it over to the extcap dir of my wireshark installation, but it feels like something needs to be added on mac to intercept the packetfix:// url schema and open wireshark, because nothing happens when I click on the "fin" in the Edgeshark UI. Using Chrome browser.

ADD1: when I copy/paste the packetfix:// link and paste in the packetfix capture option in the Wireshark UI it all works correctly.
So it is only the matter of opening up the wireshark when I this link is opened by the browser.

Thanks!

[thediveo]

We were afraid that this would come up 😁

For myself, I lack the needed macOS knowledge to write an installer and additionally register the needed capture URL handler. I didn't find a colleague having the knowledge and wanting to contribute, so we're at this point reliant on other devs contributing. I'm willing to test though, as I have snatched up an old Intel macbook (that is perfectly fine BTW).

[hellt]

gotcha, thanks @thediveo
Edgeshark is too good to let it go and I see thousands of happy network engineers using this in various scenarios.

Not a macos dev myself either, but this should be still accurate and working -- https://www.802101.com/wireshark-integration-with-unetlab-on-osx/

[hellt]

I used Apple Script Editor to open the script

here is its contents

on open location this_URL
	set get_date to do shell script "date +%Y%m%d-%H%M%S"
	set cap_URL to this_URL
	set new_cap_HOST to word 2 of cap_URL
	set new_cap_INT to word 3 of cap_URL
	set capturefile to new_cap_INT & "-" & text 1 thru 15 of get_date
	# set cap_out to capture.new_cap_INT
	# display dialog new_cap_HOST
	# display dialog new_cap_INT
	tell application "Terminal"
		activate
		do script "mkfifo /tmp/" & capturefile
		do script "wireshark -k -i /tmp/" & capturefile
		do script "ssh root@" & new_cap_HOST & " tcpdump -U -i " & new_cap_INT & " -s 0 -w - > /tmp/" & capturefile
	end tell
end open location

Now I think all I need is to pass the URL to the wireshark app, without any of that extra bits that save the pcap

[thediveo]

I'm wondering if the tell can target Wireshark instead of the Terminal wrapper? On Linux, the desktop file boils down to:

Exec=wireshark -k -i packetflix -o extcap.packetflix.url:%u

...where %u is the URL passed to the invokation.

BTW, I suspect since that apple script probably predates the sshdump extcap plugin, it does basically what the sshdump plugin now does, and could be reduced to invoking Wireshark with -i sshdump plus the destination host to log into; the sshdump extcap then does the piping magic, feeding the remote dumpcap output into the named pipe already created and passed to the extcap.

[hellt]

@thediveo yeah, I have almost finished fixing this plugin.
hopefully share this with you today

[hellt]

ADD1: maybe not so fast, looks like the script assumes the hardcoded address.. Looking into it

ADD2: Seem to work now, updated the zip file

@thediveo do you mind giving it a try?
"works on my machine", but it would be great if more people give it a try

edgeshark-handler.zip

When unarchived, you will find an applescript program title edgeshark-handler
move it to Applications on mac.

Then try using the FIN in the web UI. The prompt should appear

Maybe another prompt will appear saying that it is not wise to run scripts downloaded from the internet, in that case you need to go to global Settings -> Privacy And Security and under the Security section there will be a prompt to allow the script to run (not shown on the screenshot below)

[hellt]

I did a quick test with a colleague and it worked nicely.
Will do some docs around this on https://containerlab.dev and share with you

[thediveo]

Will try tomorrow when in office.

There's a nice story behind your contribution you can't yet be aware of: we originally started years back using GNS3 with its absolutely fresh beta Docker support, and that brought me into container networking, giving eventually birth to Edgeshark. Now things circle back to using Edgeshark for containers for network simulation in form of Containerlab.

[hellt]

Will try tomorrow when in office.

There's a nice story behind your contribution you can'tyet be aware of: we originally started years back using GNS3 with its absolutely fresh beta Docker support, and that brought me into container networking, giving eventually birth to Edgeshark. Now things circle back to using Edgeshark for containers for network simulation in form of Containerlab.

right, we are in the regular networking domain dreamt of a web UI for wireshark in one form or the other. Edgeshark is something that crosses off 80% from my wishlist.

I'll make sure to praise your work soon in social media. Stellar work!

[thediveo]

It'll raise a good chuckle when I report that we're getting praise from hell(t). So we need to repent, either or both on our tooling and/or container technology.

[thediveo]

btw, are you aware of the underlying csharg repository that has a blazingly stupid CLI tool? Maybe that might come in handy in x-as-code in case you need to pipe your capture stream into something different than Wireshark, because you're doing some automated processing.

[hellt]

I am not, I saw it being mentioned in the docs though, but haven't checked this.

I wonder if it is feasible at all to raise UI/UX enhancements to the edgeshark or is it more or less a "finished" project and not something that is actively developed now?

For instance, I'd appreciate substring filtering of nodes shown in the UI

[thediveo]

we open sourced it so that there can be community contributions.

[thediveo]

Let's discuss the ui/ux then separately. I wonder if in your case a network topology view helps at all, especially I wondered on many a hike in the landscape how filtering would even work. Maybe yours might be a list/tabular view, or even just simple cards, that you can filter...?