Wireshark and nftables
Hi,
I have Wireshark installed on Linux and it works fine.
When starting Wireshark, it was starting very quickly (less the 2 seconds) until I setup nftables.
It then started to pause on 'Initializing external capture plugins' for about 20-25 seconds.
I have been trying to workout what it was stumbling over and have come up with the following;
- With only a very simple input and output chain that have 'accept' as their default states, Wireshark starts quickly.
- With either or both being set to 'drop', Wireshark pauses.
- With both being set to 'accept' and the loopback, eth, wlan interfaces all being set to 'drop', Wireshark starts quickly.
- With either or both being set to 'drop' and all the interfaces shown by Wireshark except for 'bluetooth-monitor' being set to 'accept', Wireshark pauses.
- With either or both being set to 'accept' and all the interfaces shown by Wireshark except for 'bluetooth-monitor' being set to 'drop', Wireshark starts quickly.
I am unable to add 'bluetooth-monitor' as an interface to nftables even to test. The error reported by the syntax checker is the interface names exceeds 16 characters! I also tried adding 'pan1' to nftables which compiled ok but made no difference. I should note that there is no bluetooth interface on this host
Has anyone got any suggestions;
A. what may be causing Wireshark to start slower? (Resolved : Loopack interface was blocked - see comment by @johnthacker below - thanks)
B. what troubleshooting steps I could take next? (Resolved : Thanks @Jaap, @Guy-Harris and johnthacker for your suggestions)
C. fingers crossed - what a fix might be? ;-) (Resolved : See above)
Many Thanks
Kernel 6.1.75
Wireshark 4.0.12
If you go into preferences, one the 'Capture' panel, there are two settings (Don't load interfaces at startup and Disable external capture interfaces). Does toggling these have an impact? What happening if you run dumpcap -D from the command line?
Hi @Jaap
Don't load interfaces at startup - doesn't seem to affect it, it is still slower.
Disable external capture interfaces - also doesn't seem to affect it, it is still slower.
dumpcap -D responds quickly with no delays and returns a list of all the interfaces except for the Extcap ones. So it includes the real interfaces, any, loopback, bluetooth-monitor, nflog and nfqueue.
Thank you for the pointer to dumpcap, I've used wireshark for years but never explored this option and it's perfect for something else I want to do.