[libvirt-users] Unable to libvirt wireshark dissector

[Michal Privoznik]

On 03/27/2018 08:41 AM, Han Han wrote:
> Hi guys,
> I am trying to analyze libvirt rpc protocol by wireshark. But I found
> wireshark doesn't dissect libvirt packets. Here are my environments
> operations:
> 
> 1. Environments:
> My system: Debian GNU/Linux buster/sid with *kernel-4.15.0-1-amd64*
> Packages installed:
> 
> 
> *libvirt0-4.1.0-2-amd64 libvirt-wireshark-4.1.0-2-amd64
> wireshark-2.4.5-1-amd64*
> 2. Libvirt configurations
> */etc/libvirt/libvirtd.conf*:
> 
> 
> 
> *listen_tls = 0listen_tcp = 1tcp_port = "16509"auth_tcp = "none"*
> 
> Libvirtd started with options
> 
> 
> *--listen*
> 3. Check wireshark libvirt plugin:
> Open menu: *Help* --> *About* *wireshark* --> *Plugins*. Libvirt plugin is
> found:
> *libvirt.so 4.1.0 dissector
> /usr/lib/x86_64-linux-gnu/w…rk/plugins/2.4.5/libvirt.so*
> 
> 
> 4. Set wireshark listening on *lo* interface and filter as
> 'tcp.port==16509'. Execute virsh command via tcp protocol:
> $ virsh -c qemu+tcp://localhost/system list
> 
> In wireshark, packets are parsed as TCP protocol. And I cannot find Libvirt
> protocol in 'Decode as..' protocols list. And libvirt protocol is also not
> found in *Edit* --> *Preference* --> *Protocols*.
> 
> So it seems libvirt packets are not dissected as libvirt protocol in
> wireshark. How can I use the wireshark libvirt plugin?

This is weird. It's working for me. Looks like your libvirt plugin is
not loaded. If you build the wireshark plugin from libvirt.git and then
copy it to "~/.config/wireshark/plugins/libvirt.so" does it help?

Michal