Packet Capture on Fuchsia

Packet capture is a fundamental tool for developing, debugging, and testing networking.

Fuchsia provides target-side packet capturing capabilities via the net CLI tool (part of net-cli).

Running the ffx net capture plugin on the host

The ffx net capture host plugin allows managing rolling captures directly from your development host.

Start a rolling capture

[host] $ ffx net capture start-rolling name:lo

You can optionally specify a packet filter using standard pcap-filter syntax, just like for tcpdump or tshark. See the help string for other arguments that the start command takes or the README for more examples.

The default, minimum, and maximum buffer sizes are defined in FIDL, and the resulting rolling packet capture will contain as many of the most recently captured packets that fit the negotiated buffer size. The --snap-len argument can also be used so that only the first N bytes of each packet is captured instead of the entire packet, which can help fit more packets into the capture since the contents of the payload is often not relevant.

Stop and download a rolling capture

[host] $ ffx net capture stop-rolling

This stops the capture, downloads the accumulated packet capture directly to your development host, and prints the path on the host where the pcapng file has been saved.

Running the net binary on the target directly

In order to run the net tool on the target directly, ensure //src/connectivity/network/net-cli is included in your build.

Usage is otherwise virtually identical to the ffx plugin.

[target] $ net capture start-rolling name:lo
[target] $ net capture stop-rolling

Running tcpdump on the target directly

Ensure that //third_party/tcpdump is included in your build so that tcpdump can be run on the target directly.

Reference: fx workflow packet signatures

There are many different kinds of services running between the Fuchsia development host and the target. Those are usually invoked by fx commands. Most of times, you are not interested in those packets generated by the fx workflows. The following table lists noteworthy signatures.