Ask Your Question
0

Why is Wireshark getting "could not connect to display" when run from a Kubernetes pod?

asked 2022-12-30 06:19:23 +0000

RajiRavi gravatar image

updated 2022-12-30 20:48:21 +0000

Guy Harris gravatar image

Hi Team,

We are trying to integrate wireshark tool with our application, just to view the pcap log files via wireshark. Our application is based out of kubernetes pods running on Linux. So we have created a pod for wireshark, using the available wireshark docker image. And able to access the wireshark service from our application.

Usecase: When clicked on the pcap log file in my application, it should open the pcap file via wireshark GUI.

Below are the issues we face:

1) We are able to open the pcap files via wireshark manually only (Wireshark->File->Open). As searched in the documentation, there are no API's available to automate opening of files via wireshark. Any help here would be appreciated.

Limitation: Also the pcap files should be placed in the config folder before trying to open.

2) As the above is the case, tried to open the pcap file using the command line option: "wireshark -r <filename>" from the pod where wireshark is installed.

This throws the below error:

* (wireshark:138266) 11:24:50.830804 [GUI WARNING] -- could not connect to display * (wireshark:138266) 11:24:50.830877 [GUI ERROR] -- This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.

Aborted (core dumped)

Tried installing wireshark-qt as well, still same issue.

Kindly assist if there are any API's available or any other way to open the pcap files via wireshark GUI. Let me know if additional information is needed.

Thanks in advance.

edit retag flag offensive close merge delete

Comments

Does the machine on which you're trying to run Wireshark have a display, or is it headless, with, at most, a serial port console?

If it has a display, is the shell from which you're running Wireshark in a window on that display?

What do the commands

echo $DISPLAY
echo $WAYLAND_DISPLAY

print?

Guy Harris gravatar imageGuy Harris ( 2023-01-03 06:10:42 +0000 )edit

My wireshark is running on a pod. I exec into the pod and tried the above commands. The result is empty.

RajiRavi gravatar imageRajiRavi ( 2023-01-03 07:05:27 +0000 )edit

My wireshark is running on a pod.

And the code in the pod ultimately has to run on one or more machines. Do the machine or machines on which you're trying to run Wireshark have a display, or are they headless, with, at most, a serial port console?

Guy Harris gravatar imageGuy Harris ( 2023-01-03 19:49:39 +0000 )edit

Its a bastion server.

RajiRavi gravatar imageRajiRavi ( 2023-01-05 06:08:55 +0000 )edit

Its a bastion server.

So I shall assume it's a headless server in a machine room, and that "We are able to open the pcap files via wireshark manually only" means you're running Wireshark on your desktop machine, rather than on the server, and that you've either copied the capture files from the server to your desktop machine or are accessing them from a file server.

Is that correct?

Guy Harris gravatar imageGuy Harris ( 2023-01-06 01:55:34 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
0

answered 2023-01-13 00:53:26 +0000

Guy Harris gravatar image

My server is running on Public cloud (AWS/Azure)

Congratulations, you've just told me you're not using a keyboard, mouse, and monitor attached to the server without telling me you're not using a keyboard, mouse, and monitor attached to the server. :-)

So you're running Wireshark over X11, displaying on your desktop computer.

You will need to make sure that, when you click on the capture file in the list of capture files, whenever runs Wireshark ensures that 1) the DISPLAY environment variable is set to point to your desktop computer's X server and 2) programs in the pod that contains Wireshark are allowed to connect to your desktop machine's X server.

edit flag offensive delete link more
0

answered 2022-12-30 10:34:40 +0000

Jaap gravatar image

You are on the right way using the command line to load a capture file into Wireshark on startup.

With respect to the startup issue you describe, this has everything to do with the way the platform running Wireshark is setup. Somehow this prevents access to the display for Wireshark to display its application window. This would be true for any GUI application (Qt based or otherwise).

edit flag offensive delete link more

Comments

Thanks for the response Jaap. Could you please let me know if we have any documentation to resolve this issue.

It would also be helpful if we have APIs for wireshark.

RajiRavi gravatar imageRajiRavi ( 2023-01-02 06:55:52 +0000 )edit

I couldn't help you with any documentation related to you platform, that's up to your platform. Information on Qt can be found on the Qt website. As for APIs for Wireshark, I'm not sure what you mean. This is a desktop application, not some server backend tool. You can interface with it using the command line, which opens up a wealth of configurable item.

Jaap gravatar imageJaap ( 2023-01-02 12:27:35 +0000 )edit

If you want to run QT based application like this I suggest you look at https://doc.qt.io/QtApplicationManage... and similar stuff. This is not wireshark specific.

If you want to od some packet actiosn you can eithr interface didrectly with libpcap and do all the heavy liftng yourself. or see whatt tshark as cli command might bring you.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2023-01-02 13:07:51 +0000 )edit

Thanks Jaap and Hugo for the response. @Jaap, By API's for wireshark - I mean, Just wanted to check if there is any webinterface for Wireshark. Also wanted to know if there are any GET API's available for wireshark, in order to automate.

RajiRavi gravatar imageRajiRavi ( 2023-01-03 05:56:04 +0000 )edit

Just wanted to check if there is any webinterface for Wireshark. Also wanted to know if there are any GET API's available for wireshark, in order to automate.

No, it's a desktop application, not a Web server.

Guy Harris gravatar imageGuy Harris ( 2023-01-03 06:02:46 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-12-30 06:19:23 +0000

Seen: 394 times

Last updated: Jan 13