Allow to select multiple interfaces from one node and capture them simultaneously

[tiago-amado]

Hi.
Very nice project, congrats to all!
I was testing EdgeShark, and indeed this is amazing!

Sometimes we may have a node with many interfaces and we just want to capture a few of them. It would be nice if we could select which interfaces we could capture (e.g. a check-box) and them capture only the selected interfaces simultaneously.

Not sure if its possible, but if we could insert the Wireshark display filter (e.g. "icmp or mpls") in the webUI and then once we open the wireshark the filter would be automatically populated and the traffic shown already filtered.

Thank you!

[thediveo]

Multi-Interface in WebUI

That should be doable and hopefully straightforward. What about an additional "multi-fin" button for the whole network namespace card? When touched, this pops up first a list where you can tick off the interfaces you want?

Capture Filters

Here, we need to differentiate between the display and the capture filters, because the first we don't have control over, but the second is something I can channel through. In fact, this is already available, albeit Wireshark does it hide deep inside its menus, so its really not very accessible.

How about having a popup dialog that tells users that they're going to be transferred to a Wireshark session and asks them for an optional capture filter? The unfortunate thing is that there isn't any validation of the filter string beforehand: we would need a Javascript lib for that. Any mistakes will fail only later and I'm fearing a little bit the probably not really error messages thrown and which we might not get properly back to Wireshark through Wireshark's extcap pipe.

[tiago-amado]

Multi-Interface in WebUI

I was thinking of a checkbox next do the fin of each interface, then user could select multiple (from a single node only) and then a button to start the capture for the selected interfaces.

Capture Filters

I was referring to the display filters that shows up on the Wireshark window. Indeed user can insert it after launching wireshark, but if we have it populated in the WebUI, user can launch multiple instances without repeating the same filter.

Maybe an optional setting that if enable provides a text-box to populate the filter to apply (with history to display previous used queries). Yes it could also present a dialog for the user to insert, confirm or change the filter.

I was not thinking in prior validations. If for some reason the user inserts a wrong query, wireshark will complain and he could fix the typo directly on the Wireshark.

[thediveo]

There is unfortunately no way for us to access/populate Wireshark UI elements. All we have goes to/through the extcap via the extcap-related and very limited CLI args.

[hellt]

what if we allow selecting multiple interfaces in the UI by clicking on the appropriate boxes with interface details, and then when several interfaces are selected, then the Fin that is next to the container/namespace name starts to capture from these interfaces instead of "all" namespace interfaces?

A click outside of the interface box clears the multiselection of the intefaces

[thediveo]

re: display filter; while there actually is a CLI arg for setting the display filter (https://www.wireshark.org/docs/wsug_html_chunked/ChCustCommandLine.html) I don't see yet how to channel this through the URL scheme handlers on all the different OS platforms, and without the need to end up in a very brittle processing chain requiring additional dependencies. The extcap plugin has no control here over Wireshark, except for a very few properties.

Having said this, PRs covering the three platform will be highly welcome nevertheless.

[thediveo]

early poc atm

new multi-fin button in each network namespace/container card to switch into nif selection:

multi-fin button indicates that it is active, a capture button appears next to it on the left; this capture button only becomes enabled when there are network interfaces selected. the capture buttons on interfaces turn into check boxes for selection. the capture buttons on containers disappear while in multi-fin mode.

click on capture button in top right to start capture from selected interfaces only.

click on multi-fin button to leave selection mode and return to the per container/interface mode.

selection state is only kept while in session, so reloading the whole UI starts afresh. we cannot keep this as "hidden" and surprising state in browser persistent state, not least, there's no garbage collection.

[tiago-amado]

Just tested and its fantastic!
Very nice work and super fast! Many many thanks!

[thediveo]

🎉 Released as Ghostwire v2.4.0; grab the latest images while they're hot.

But now the feature rate limiter needs to kick in, and we seriously have to switch over to the contribution PR phase 😉

[hellt]

thanks!

[thediveo]

As for the capture filtering, please create a new feature idea anyway, so we don't mix different ideas.

[hellt]

I don't personally have a strong need for the display filters, but just wanted to mention this based on your comment:

Here, we need to differentiate between the display and the capture filters, because the first we don't have control over

Using the Wireshark's extra CLI options (the same way we set the window title) we can instruct wireshark to open with the display filter set.

But again, I don't think this is the edgeshark's zone of responsibility...

[tiago-amado]

My bad, I shouldn't have mixed this, I'll create the new feature idea for the display filters.
If we have a network topology and we want to show the capture in multiple nodes, we need to manually populate the display filter in all of them. With this feature, we open multiple Wireshark sessions and the display filter is already in place.
But indeed, this is a "nice to have".