Red Hat Bugzilla – Bug 1464362
RFE: AF_VSOCK support in libpcap
Last modified: 2017-12-19 11:47:18 EST
The vsockmon kernel module offers packet capture for AF_VSOCK traffic sent between the host and virtualized KVM guests. (It works in a similar way to the nlmon module for netlink packet capture.)
More info here:
I am working upstream to add AF_VSOCK support to the libpcap/tcpdump/wireshark stack so that users can analyze traffic for troubleshooting or during development.
The request for a pcap linktype assignment is here:
Upstream has not been responsive. I am now trying to ping Guy Harris and Michael Richardson to see if we can make progress. Any help would be appreciated!
Once the linktype is assigned I will submit the libpcap patch upstream. That would need to be included in RHEL so that tcpdump/wireshark can capture AF_VSOCK packets.
Patches posted upstream: