I created a mininet network (single) with 4 hosts and one switch. and try to capture packets using Wireshark. The problem which interface I have to select?
the available interfaces:
eth0
s1-eth1
s1-eth2
s1-eth3
s1-eth4
any
loopback: lo
the problem:
* If I select s1-eth1 it will just show packets from and to host 1. and the same issue if I select similar interfaces s1-eth2, s1-eth3....
* when use loopback (lo): it just show the local IP (127.0.0.1) and the OFPT_PACET_IN for first time when the sender connect to a new host, the next transactions are not shown.
* when use (any): it shows the results two times (I think one from the sender interface and the next from the receiver side interface) in addition to 127.0.0.1
I need to see all packets in the network from any host to any destination without duplications
Haven't you tried to capture the flows one-by-one, and then, generate a new set by gathering all of them? possible? once capturing them 'simultaneously' is disabled.
Indeed, Wireshark has the possibility to merge several capture files: https://www.wireshark.org/docs/wsug_html_chunked/ChIOMergeSection.html
And from the Mininet terminal it is possible to open 4 Wireshark sessions, one for each host:
mininet> h1 wireshark &
mininet> h2 wireshark &
mininet> h3 wireshark &
mininet> h4 wireshark &
// the & character starts the process in the background so the CLI is not blocked and subsequent commands can be executed
But this still doesn't help because merging 2 traffic capture files will generate the same duplicated result (one packet which is sent from capture1 will be seen as received in capture 2 -> duplicated in the merge).
One option might be to attempt to remove duplicated packets using editpcap: https://www.wireshark.org/docs/man-pages/editcap.html See the -d -I -w parameters
If you find a different solution different than editpcap please share it.
- Badges
- Science topic
- Similar topics
- Computer Communications (Networks)
- Simulators