QA (public) » openQA Project (public) » openQA Tests (public)

We can use tshark , a command-line interface for Wireshark, that supports similar options to capture packet data from live connections, to write the packets to a file and to read/verify packets from a previously saved capture file.

Below are the test steps,

1. Capture packets:¶

Start capture via terminal using the tshark command in the background (and also generate the DNS request traffic in the current test) and save the captured data in a file.
   for e.g., Command : tshark  -i ens3 -f "port 53" -w /tmp/capture.pcap
   In the above tshark command, “-i” option begins the capture process from ens3 interface; capture filter "-f" option captures packets from ports 53  only and "-w" options saves 
   the captured traffic to a file.

2. Verify the capture:¶

Read the specific captured packet in the saved file by passing the display filter (option "-Y") and verify the packet count. If the packet count is non-zero then proceed to 
verify the required field value. 
   for e.g., Dns request packet count: tshark -r /tmp/capture.pcap  -Y "dns.a && dns.qry.name== www.suse.com"  | wc -l 
   then we can use options “-T field” and "-e" to extract fields as per our choice. see command usage below,
   command : tshark -r /tmp/capture.pcap  -Y "dns.a && dns.qry.name== www.suse.com"   -T fields  -e "dns.qry.name" -e "dns.qry.type"

Santiago, should I go with the above steps to modify the current wireshark test? please confirm.

This ticket was set to Normal priority but was not updated within the SLO period. Please consider picking up this ticket or just set the ticket to the next lower priority.