Wireshark

Table of Contents TODO: Introduction Build Wireshark Install dependencies Checkout Experimental Wireshark Code Build Wireshark Suggested Wireshark Filters Capture Filters Display Filters

TODO:

Check list of required packages and build instructions

Introduction

The XIA team at Boston University has added support for XIA in the shipping version of Wireshark. In addition to the XIP header, it also decodes some of the protocols they have developed. Unfortunately, this shipping version doesn't support the the protocols in the CMU implementation of XIA.

We have an experimental version of Wireshark that includes support for the following additional information:

• XSP packets
• XDP packets
• XARP packets
• XCMP packets
• FID headers

Support for the Network Joining Protocol is not included as it uses Google protobufs to construct it's packets which are not easily supported with Wireshark.

Build Wireshark

Install dependencies

sudo apt-get install autogen autoconf libtool libtool-bin bison byacc flex libpcap-dev libgtk-3-dev

Checkout Experimental Wireshark Code

git clone https://github.com/XIA-Project/wireshark
cd wireshark
git checkout xia

Build Wireshark

cd wireshark
./autogen.sh
./configure --with-dumpcap-group=wireshark --enable-setcap-install --with-libcap
make
make install

Suggested Wireshark Filters

XIA Ethernet Protocols

• XIP 0xc0de
• XARP 0x9990
• Xnetj 0x9991

Capture Filters

Using capture filters will help cut down overall packet trace size.

# all XIA related Traffic
(ether proto 0xc0de) || (ether proto 0x9990) || (ether proto 0x9991)

# XIA related traffic with broadcasts filtered out
(ether proto 0xc0de) || (ether proto 0x9990) || (ether proto 0x9991) && !(ether dst ff:ff:ff:ff:ff:ff)

# Just XIP and XARP with no broadcasts (most useful)
(ether proto 0x9990) || ((ether proto 0xc0de) && !(ether dst ff:ff:ff:ff:ff:ff))

Display Filters

To trim down what is displayed in wireshark.

# all XIP and XARP packets
xip && xarp

# just streaming packets
xstream

# just datagram packets
xdgram

# just xcmp packets
xcmp

# to eliminate broadcast packets add the following to any of the other display filters
&& !(eth.dst == ff:ff:ff:ff:ff:ff)