f5-rahm/pcap_utils

PCAP Utilities

This project is a collection of utilities to generate, download, and work with BIG-IP packet captures.
Report Bug · Request Feature

Table of Contents

About The Project
- Built With
Getting Started
- Installation
Usage
Roadmap
Contributing
License
Contact
Acknowledgments

Built With

(back to top)

Getting Started

This is an example of how you may give instructions on setting up your project locally. To get a local copy up and running follow these simple example steps.

Installation

Clone the repo

git clone https://github.com/f5-rahm/pcap_utils.git

Create and activate a virtual environment

# linux/macos
python3 -m venv /path/to/new/virtual/environment
source <venv>/bin/activate
# windows
c:\>c:\Python39\python -m venv c:\path\to\myenv
# cmd.exe
C:\> <venv>\Scripts\activate.bat
# powershell
PS C:\> <venv>\Scripts\Activate.ps1

Install requirements
```
pip install -r requirements.txt
```

(back to top)

Usage

The first utility in this project, support_captures.py, takes no arguments, but does require three environment variables:

F5_HOST
F5_USER
F5_PASS

Once starting the script, it will ask you for three things:

The virtual server under test
The client IP you will be testing from (and that is observable inbound on BIG-IP)
The F5 support case number you'll upload files to

Once the tcpdump capture is started for you, you'll have about 50 seconds to reproduce your issue. This might be extensible but YMMV. Here's a sample run through the script with the ssl profile cache set to zero.

python support_captures.py


	#################################################
	### BIG-IP tcpdump capture collection utility ###
	#################################################

	Virtual name: ext_nerdknobs.tech_443
	Client IP for test traffic: 174.209.224.94
	Case number: C245197
	
	-------------------------------------------------

	Virtual ext_nerdknobs.tech_443 has associated client-ssl profile cssl_nerdknobs.tech...continuing.
	Session keylogger iRule (cache disabled version) created...continuing.
	Session keylogger iRule applied to ext_nerdknobs.tech_443...continuing.
	Starting tcpdump...please reproduce your issue now.
	Session keylogger iRule removed from ext_nerdknobs.tech_443...continuing.
	keylogger iRule deleted...continuing.
	Secrets key file created (with cache disabled command)...continuing.
	Starting qkview...standby.
	Qkview still running...sleeping 10 seconds.
	Qkview complete...continuing.
	Downloading support files from BIG-IP.
		C245197_2022-04-06.pcap downloaded.
		C245197_sessionsecrets.pms downloaded.
		C245197_ltm3.test.local.qkview downloaded.
	All support files downloaded...continuing.
	Cleaning up support files on BIG-IP.
		C245197_2022-04-06.pcap deleted.
		C245197_sessionsecrets.pms deleted.
		C245197_ltm3.test.local.qkview deleted.
	All support files cleaned up on BIG-IP...complete.
	
-------------------------------------------------

Please upload files in output_files directory to your support case or to supportfiles.f5.com using credentials provided by your case worker.

(back to top)

Roadmap

Utility to decrypt downloaded BIG-IP captures
Utility to match and visualize clientside/serverside BIG-IP flows using f5ethtrailer details
Utility to isolate SIP/RTP flows
APM flow clarity, issue isolation

See the open issues for a full list of proposed features (and known issues).

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!