[Support] Linuxserver.io - Wireshark

[linuxserver.io]

 

Application Name: Wireshark
Application Site: https://www.wireshark.org/
Docker Hub: https://hub.docker.com/r/linuxserver/wireshark/
Github: https://github.com/linuxserver/docker-wireshark

 

Please post any questions/issues relating to this docker you have in this thread.

If you are not using Unraid (and you should be!) then please do not post here, rather use the linuxserver.io forum for support.

[mihcox]

I just spun up this docker and am getting a 519 error. I noticed that this loaded to port 3000, the same port i have grafana on. I moved it and then got the below error. Obviously I'd prefer to customize wireshark so that i can leave my existing dockers as they are. Can you provide an example on how to change the port allocations for wireshark in the unraid docker template?

 

[Squid]

36 minutes ago, mihcox said:

I just spun up this docker and am getting a 519 error. I noticed that this loaded to port 3000, the same port i have grafana on. I moved it and then got the below error. Obviously I'd prefer to customize wireshark so that i can leave my existing dockers as they are. Can you provide an example on how to change the port allocations for wireshark in the unraid docker template?

 

This app is set to run as network type "host".  IE: Any and all port mappings are irrelevant (and there are no port mappings within the template to boot).  What you presumably did what change the webUI entry which would have no affect, and would wind up pointing it at grafana.

 

If you need to move the the applicable port that the app is running on, you either need to change the network type to be "Bridge" and add any and all port(s) it uses (it would need at the minimum port 3000), or specify a custom IP address for it to be on (not sure if that would affect the function of the container or not).

 

First thoughts though is that this app needs to be run as host, and you should fix the problem at grafana instead

[saarg]

1 hour ago, mihcox said:

I just spun up this docker and am getting a 519 error. I noticed that this loaded to port 3000, the same port i have grafana on. I moved it and then got the below error. Obviously I'd prefer to customize wireshark so that i can leave my existing dockers as they are. Can you provide an example on how to change the port allocations for wireshark in the unraid docker template?

 

As squid says, this container needs host networking. It is a network sniffing tool and isn't any good if it can't listen to the network.

 

So either change grafana to another port or set this container to use its own IP.

[mihcox]

2 hours ago, saarg said:

As squid says, this container needs host networking. It is a network sniffing tool and isn't any good if it can't listen to the network.

 

So either change grafana to another port or set this container to use its own IP.

Solved, thank you

[folic86]

Hi guys, this docker appears to have grown to 7gb, so I think I buggered up the set up. (Please see attached)

[tjb_altf4]

Hi,

did some quick investigation on this looking into @folic86's issue, and the packet capture data is being written directly to the container itself.

My experience: 

• 10min of packet capture blew up the container size by 2GB
• stopping packet capture, stopped the container from increasing in size further
• forcing a container update returned the container size to normal.

I would imagine this data path would be best pushed to appdata folder or a share etc.