Wireshark remote capture with GNS3

So far GNS3 introduced a great way to use it in distributed mode; however, there is a problem: wireshark can not intercept traffic on routers being run on a remote server right now. While developers announced support for remote capture in version 1.4 there is a way to make it work in 1.3 also.

Of course I am assuming that you have ssh access to a remote machine where GNS3-server is running. And as I use exclusively Linux on all of my machines, this guide will cover this OS only.

My virtual GNS3 lab

For most of my experiments I use great program GNS3. Recently I switched from legacy 0.8, included in most distributions, to modern branch version 1.3. It was difficult in the beginning to figure out how to install it but once I made it, things became much easier. New features, like auto discovery of IdlePC for any Cisco router saves a lot of time, and ability to move server to another machine is really helpful. Here I would like to describe my lab and task I use it for.

ISIS route leaking in IOS XR and XE

Route leaking is useful in some situations when there are more than one exit from an area, like on this picture:

Note: address scheme for most of my schemes - lo0 on every router is 1.1.1.1 on router 1, 2.2.2.2 on router 2 , etc; interrouter links 10.0.XY.X/24 and 10.0.XY.Y/24 where X - number of one router and Y of another. So, for address 10.0.25.5 it can be said that this is R5 side of the link between R2 and R5.

Assuming that all links in this diagram are equal it is obvious that for R6 to reach R5 path through R7 - XE2 - R5 should be used as it has less hops, however in reality R6 will try to reach both R3 and R5 through XR-1 router with 2 and 4 hops respectfully, and R7 will go to R3 and R5 via XE2. This can be confirmed with traceroute from R6:

R6#traceroute 3.3.3.3
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)
  1 10.0.16.1 28 msec 4 msec 8 msec    <============ XR1
  2 10.0.13.3 16 msec 16 msec 16 msec  <============ R3

R6#traceroute 5.5.5.5
Type escape sequence to abort.
Tracing the route to 5.5.5.5
VRF info: (vrf in name/id, vrf out name/id)
  1 10.0.16.1 4 msec 12 msec 8 msec    <============ XR1
  2 10.0.14.4 12 msec 32 msec 16 msec  <============ R4
  3 10.0.24.2 16 msec 28 msec 28 msec  <============ R2
  4 10.0.25.5 24 msec 36 msec 36 msec  <============ R5

And from R7:

R7#traceroute 3.3.3.3
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)
  1 10.0.27.2 8 msec 12 msec 8 msec    <============ XE2
  2 10.0.24.4 16 msec 8 msec 8 msec    <============ R4
  3 10.0.14.1 4 msec 16 msec 16 msec   <============ R1
  4 10.0.13.3 16 msec 20 msec 16 msec  <============ R3

R7#traceroute 5.5.5.5
Type escape sequence to abort.
Tracing the route to 5.5.5.5
VRF info: (vrf in name/id, vrf out name/id)
  1 10.0.27.2 12 msec 8 msec 12 msec   <============ XE2
  2 10.0.25.5 12 msec 12 msec 4 msec   <============ R5

To fix this issue route leaking can be used on XR1 and XE2.