[libvirt-users] Unable to libvirt wireshark dissector

[Han Han]

Hi guys,
I am trying to analyze libvirt rpc protocol by wireshark. But I found
wireshark doesn't dissect libvirt packets. Here are my environments
operations:

1. Environments:
My system: Debian GNU/Linux buster/sid with *kernel-4.15.0-1-amd64*
Packages installed:


*libvirt0-4.1.0-2-amd64 libvirt-wireshark-4.1.0-2-amd64
wireshark-2.4.5-1-amd64*
2. Libvirt configurations
*/etc/libvirt/libvirtd.conf*:



*listen_tls = 0listen_tcp = 1tcp_port = "16509"auth_tcp = "none"*

Libvirtd started with options


*--listen*
3. Check wireshark libvirt plugin:
Open menu: *Help* --> *About* *wireshark* --> *Plugins*. Libvirt plugin is
found:
*libvirt.so 4.1.0 dissector
/usr/lib/x86_64-linux-gnu/w
rk/plugins/2.4.5/libvirt.so*


4. Set wireshark listening on *lo* interface and filter as
'tcp.port==16509'. Execute virsh command via tcp protocol:
$ virsh -c qemu+tcp://localhost/system list

In wireshark, packets are parsed as TCP protocol. And I cannot find Libvirt
protocol in 'Decode as..' protocols list. And libvirt protocol is also not
found in *Edit* --> *Preference* --> *Protocols*.

So it seems libvirt packets are not dissected as libvirt protocol in
wireshark. How can I use the wireshark libvirt plugin?

[Michal Privoznik]

Post by Han Han
Hi guys,
I am trying to analyze libvirt rpc protocol by wireshark. But I found
wireshark doesn't dissect libvirt packets. Here are my environments
My system: Debian GNU/Linux buster/sid with *kernel-4.15.0-1-amd64*
*libvirt0-4.1.0-2-amd64 libvirt-wireshark-4.1.0-2-amd64
wireshark-2.4.5-1-amd64*
2. Libvirt configurations
*listen_tls = 0listen_tcp = 1tcp_port = "16509"auth_tcp = "none"*
Libvirtd started with options
*--listen*
Open menu: *Help* --> *About* *wireshark* --> *Plugins*. Libvirt plugin is
*libvirt.so 4.1.0 dissector
/usr/lib/x86_64-linux-gnu/w…rk/plugins/2.4.5/libvirt.so*
4. Set wireshark listening on *lo* interface and filter as
$ virsh -c qemu+tcp://localhost/system list
In wireshark, packets are parsed as TCP protocol. And I cannot find Libvirt
protocol in 'Decode as..' protocols list. And libvirt protocol is also not
found in *Edit* --> *Preference* --> *Protocols*.
So it seems libvirt packets are not dissected as libvirt protocol in
wireshark. How can I use the wireshark libvirt plugin?

This is weird. It's working for me. Looks like your libvirt plugin is
not loaded. If you build the wireshark plugin from libvirt.git and then
copy it to "~/.config/wireshark/plugins/libvirt.so" does it help?

Michal