Bug 784893

Summary:	Feature Request: sniff a virtual interface of an guest
Product:	[Community] Virtualization Tools	Reporter:	Hendrik Schwartke <hendrik>
Component:	libvirt	Assignee:	Libvirt Maintainers <libvirt-maint>
Status:	CLOSED DEFERRED	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	crobinso, ralf, xen-maint
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-03-23 20:44:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Hendrik Schwartke 2012-01-26 15:23:51 UTC

Description of problem:

There is currently no support for sniffing the network traffic of a virtual nic, from local or remote. In some cases the debugging or monitoring of a guest is therefore not as easy as it could be.

Although it's easy to start a network sniffer on the physical host, it requires direct access to a shell and some knowledge of the current configuration of virtual networks.

I think it would be a great benefit for libvirt if network sniffing would be possible out of the box.

Comment 1 Ralf Spenneberg 2012-01-26 16:11:04 UTC

One idea would be to start a local tshark sniffing on the card and connect this to a local socket. This could then be forwarded by ssh to a wireshark process running on a desktop.

Comment 2 Dave Allan 2012-01-26 17:58:26 UTC

This sounds like an interesting piece of functionality, and I believe it could be implemented with libvirt's support for data streams.  It's unlikely that anyone will take up the task for you, but if you are willing to work on it yourself I'd suggest floating the idea on libvir-list.  You'll get a rapid response as to whether others think it would be a useful feature, which I imagine they will, as well as advice on the mechanics of implementing it.

Comment 3 Cole Robinson 2016-03-23 20:44:01 UTC

I concur with Dave, it's an interesting idea but this RFE sitting here isn't going to generate any results. It would need someone to send patches or start a mailing list discussion to drum up interest. Closing this as DEFERRED