PCAP Utilities

This project is a collection of utilities to generate, download, and work with BIG-IP packet captures.
Report Bug · Request Feature

Table of Contents

1. About The Project
   • Built With
2. Getting Started
   • Installation
3. Usage
4. Roadmap
5. Contributing
6. License
7. Contact
8. Acknowledgments

Built With

• Python
• BIGREST

(back to top)

Getting Started

This is an example of how you may give instructions on setting up your project locally. To get a local copy up and running follow these simple example steps.

Installation

1. Clone the repo

   git clone https://github.com/f5-rahm/pcap_utils.git

2. Create and activate a virtual environment

   # linux/macos
   python3 -m venv /path/to/new/virtual/environment
   source <venv>/bin/activate
   # windows
   c:\>c:\Python39\python -m venv c:\path\to\myenv
   # cmd.exe
   C:\> <venv>\Scripts\activate.bat
   # powershell
   PS C:\> <venv>\Scripts\Activate.ps1

3. Install requirements

   pip install -r requirements.txt

(back to top)

Usage

The first utility in this project, support_captures.py, takes no arguments, but does require three environment variables:

• F5_HOST
• F5_USER
• F5_PASS

Once starting the script, it will ask you for three things:

• The virtual server under test
• The client IP you will be testing from (and that is observable inbound on BIG-IP)
• The F5 support case number you'll upload files to

Once the tcpdump capture is started for you, you'll have about 50 seconds to reproduce your issue. This might be extensible but YMMV. Here's a sample run through the script with the ssl profile cache set to zero.

python support_captures.py


	#################################################
	### BIG-IP tcpdump capture collection utility ###
	#################################################

	Virtual name: ext_nerdknobs.tech_443
	Client IP for test traffic: 174.209.224.94
	Case number: C245197
	
	-------------------------------------------------

	Virtual ext_nerdknobs.tech_443 has associated client-ssl profile cssl_nerdknobs.tech...continuing.
	Session keylogger iRule (cache disabled version) created...continuing.
	Session keylogger iRule applied to ext_nerdknobs.tech_443...continuing.
	Starting tcpdump...please reproduce your issue now.
	Session keylogger iRule removed from ext_nerdknobs.tech_443...continuing.
	keylogger iRule deleted...continuing.
	Secrets key file created (with cache disabled command)...continuing.
	Starting qkview...standby.
	Qkview still running...sleeping 10 seconds.
	Qkview complete...continuing.
	Downloading support files from BIG-IP.
		C245197_2022-04-06.pcap downloaded.
		C245197_sessionsecrets.pms downloaded.
		C245197_ltm3.test.local.qkview downloaded.
	All support files downloaded...continuing.
	Cleaning up support files on BIG-IP.
		C245197_2022-04-06.pcap deleted.
		C245197_sessionsecrets.pms deleted.
		C245197_ltm3.test.local.qkview deleted.
	All support files cleaned up on BIG-IP...complete.
	
-------------------------------------------------

Please upload files in output_files directory to your support case or to supportfiles.f5.com using credentials provided by your case worker.

(back to top)

Roadmap

• Utility to decrypt downloaded BIG-IP captures
• Utility to match and visualize clientside/serverside BIG-IP flows using f5ethtrailer details
• Utility to isolate SIP/RTP flows
• APM flow clarity, issue isolation

See the open issues for a full list of proposed features (and known issues).

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

(back to top)

License

Distributed under the Apache 2.0 License. See LICENSE for more information.

(back to top)

Contact

Your Name - @jasonrahm - [email protected]

Project Link: https://github.com/f5-rahm/pcap_utils

(back to top)

Acknowledgments

• Jay Smellow
• Delane Jackson
• The Python Community
• Othneil Drew for this readme template!

(back to top)