Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionStefan Hajnoczi
2017-06-23 10:45:14 UTC
KVM is adding AF_VSOCK support for host<->guest communication. See related bz#1464362 for the libpcap prerequisite.
The AF_VSOCK address family offers SOCK_STREAM semantics similar to TCP. It does not use Ethernet/IP/TCP. For details see:
http://wiki.qemu.org/Features/VirtioVsock
I am working to add AF_VSOCK packet capture to Wireshark so that users can troubleshoot and analyze guest<->host traffic. The AF_VSOCK packet capture format is described here:
http://lists.sandelman.ca/pipermail/tcpdump-workers/2017-May/000772.html
Once the feature lands upstream it will be possible to backport it to RHEL.
The following patches are required from upstream:
$ git log --oneline epan/dissectors/packet-vsock.c
73d9550 vsock: add missing vsockmon header reserved field
41415aa vsock: add WTAP_ENCAP_VSOCK constant
e2f36ef vsock: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang
55069da Add vSocket dissector
Created attachment 1299894[details]
Example AF_VSOCK packet capture file
I have attached an example AF_VSOCK packet capture file. Use this to test the Wireshark dissector.
Upon opening the file in Wireshark you should see the following Op: RW frames (among other frames):
No 3, 3->host, Payload: Hello\n
No 5, 3->host, Payload: World\n
No 7, host->3, Payload: Hi :-)\n
(In reply to Michal Ruprich from comment #17)
> (In reply to Stefan Hajnoczi from comment #3)
> > The following patches are required from upstream:
> >
> > $ git log --oneline epan/dissectors/packet-vsock.c
> > 73d9550 vsock: add missing vsockmon header reserved field
> > 41415aa vsock: add WTAP_ENCAP_VSOCK constant
> > e2f36ef vsock: Fix Dead Store (Dead assignement/Dead increment) Warning
> > found by Clang
> > 55069da Add vSocket dissector
>
> I created a patch from these commits but it needed some more work, because a
> lot of functions are either missing or are a bit different.
>
> Stefan, the output of tshark now looks good but I am concerned with
> capturing. Do you have the means to use this older package and try to
> capture some vsock communication with it? Then try to print it out?
>
> Here is a scratch build:
> https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=16766863
Tested-by: Stefan Hajnoczi <stefanha>
I ran it inside a RHEL 7.5 guest:
# ip link add vsockmon0 type vsockmon
# ip link set vsockmon0 up
# tshark -w /tmp/vsock.pcapng -i vsockmon0
I've attached the pcap file. It contains a single SOCK_STREAM connection where "Hello" and "world" were sent between the server and client.
tshark printed the conversation correctly:
1 0.000000000 3 -> host vSocket 76 [Connect] Virtio: Stream, Op: Request, Buf alloc: 262144, Fwd cnt: 0
2 0.000107936 host -> 3 vSocket 76 [Connect] Virtio: Stream, Op: Response, Buf alloc: 262144, Fwd cnt: 0
3 2.799236146 3 -> host vSocket 82 [Payload] Virtio: Stream, Op: RW, Buf alloc: 262144, Fwd cnt: 0
4 2.799666678 host -> 3 vSocket 76 [Control] Virtio: Stream, Op: Credit update, Buf alloc: 262144, Fwd cnt: 6
5 4.949114581 host -> 3 vSocket 82 [Payload] Virtio: Stream, Op: RW, Buf alloc: 262144, Fwd cnt: 6
6 4.949296138 3 -> host vSocket 76 [Control] Virtio: Stream, Op: Credit update, Buf alloc: 262144, Fwd cnt: 6
7 9.149629676 3 -> host vSocket 76 [Disconnect] Virtio: Stream, Op: Shutdown, Buf alloc: 262144, Fwd cnt: 6
8 9.149849352 host -> 3 vSocket 76 [Disconnect] Virtio: Stream, Op: Rst, Buf alloc: 262144, Fwd cnt: 6
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2018:3089