12.2.8  
Monitoring IP Data Packages with rpcap and Wireshark (Ethereal) 
 

12.2.8.1  
Overview 

Tracing via the HIP interface  
The HIP interface (interface between HiPath 3000 and HG 1500) cannot be traced directly. However, external connections to the HIP interface via the LAN interfaces (LAN1: emac0 or LAN2: emac1) can be traced. When the rpcap service is launched, a server port of the HG 1500 opens. This enables direct access to TCP/IP packets by an IP trace tool such as e.g. Wireshark (Ethereal).
Wireshark is a program for analyzing network communication connections. It records data packets from HG 1500 and displays them clearly in a table.

rpcap (Remote Packet Capture)  
The rpcap protocol permits programs such as  Wireshark to run on the destination system as a server, recording data packets and transmitting them to a client. The client processes, analyzes and archives the data packets.

12.2.8.2  
Performing Monitoring 
To monitor the HG 1500 data packets, the rpcap service in the HG 1500 WBM and the IP trace tool Wireshark on administrator PC must be configured and started.

1. Configure and start the rpcap service of the HG 1500  
In the HG 1500 WBM, proceed as follows:
 1.   Start WBM.
 2.   Log on as a developer.
 3.   Go to Maintenance -> Platform Diagnosis -> rpcap daemon to open the "Start rpcap daemon" window.
 4.   Make the following entries in the "IP address (numeric or literal):" field:
   •  IP address of the HG 1500 (numeric or literal)
   •  HG 1500 port
 5.   Click Apply to start the rpcap daemon. A HG 1500 server port is opened.

2. Configure Wireshark and start monitoring  
In Wireshark, proceed as follows:
 1.   Start the program.
 2.   Via Capture -> Options, open the "Wireshark: Capture Options" window.
 3.   In the "Interface:" selection and input field, enter the following:
    rpcap://<IP address of the HG1500>/emac0
    or:
    rpcap://<IP address of the HG1500>/emac1
    Only the HG 1500 data packets are monitored.
 4.   In the "Capture Filter:" selection and input field, enter the following:
    not host <IP address of the administrator PC>
    The data packets of the administrator PC are excluded.
 5.   Set additional settings as appropriate, see www.wireshark.org .
 6.   Click Start to begin recording data packets. The data stream that comes from HG 1500 is displayed.

3. Stopping monitoring  
To stop monitoring, you must proceed in the following sequence in order to prevent HG 1500 from crashing:
 1.   Stop Wireshark via Capture -> Stop.
 2.   Stop the HG 1500 rpcap daemon:
   1.   In the WBM via Maintenance -> Platform Diagnosis -> rpcap daemon, open the "Stop rpcap daemon" window. Under "Client identification for access control", the HG 1500 IP address entered above is shown in the "IP address (numeric or literal):" field.
   2.   Click Apply to stop the rpcap daemon. The HG 1500 server port is closed. Access, for example  via Wireshark is no longer possible.

HiPath 3000/5000 V8, Service Documentation, Issue 10   up Top
Disclaimer & Copyright   ID: P31003H3580S100017620   2011-01-24