FMADIO Shark2
FMADIO FShark2 is a full Ubuntu desktop accessiable via RDP or HTTP client. This has the latest Wireshark binary plus additional utilis enabling full packet investigations on the system.
Port Forward Access
In many enviroments creating an additional IP for FShark2 is problematic. Instead port fowarding ports on the FMADIO Capture Appliance to the FShark2 device is a simpler apporach.
Step 1) Install FShark2 package
Download latest fshark2 release
curl -O https://firmware.fmad.io/download/container/fshark2-current.tar.gz .Example
fmadio@fmadio100v2-228U:/mnt/store0/tmp2$ curl -O https://firmware.fmad.io/download/container/fshark2-current.tar.gz .
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1292M 100 1292M 0 0 14.7M 0 0:01:27 0:01:27 --:--:-- 15.8M
fmadio@fmadio100v2-228U:/mnt/store0/tmp2$
Extract to LXC directory
sudo tar xfzv fshark2-current.tar.gz -C /opt/fmadio/lxc/Example output:
Or download an extract at the same time
Step 2) Configure LXC
Change directory to the /opt/fmadio/lxc/fshark2-<insert version>/
Run the install script. If no IP address for the container is used (e.g. fully NATed / port forward) leave the IP info blank
Example output
Step 3) Configure for NAT / Port forwarding
Comment out the lxc.net.1 (bridged interface) in the Config and set the default gateway to 192.168.255.2 (hosts internal interface)
Example Config
Step 4) AutoStart FSHARK2 on system boot
To enable automatic starting of the FSHAK2 container on system boot
Example output:
Step 5) Start the Container manually
To start the container
Example output
If it prints any messages it means there is a configuration error somewhere
Step 6) Confirm FSHAK2 is running
Check the port 3000 (HTTP browser) and 3389 (RDP) are open
Example output, can see both ports are listed
Step 6) Configure IP Port forwarding
Copy the following iptables to the configuration directory
Example output:
Manually load the iptables setting
Example output:
For reference the /opt/fmadio/etc_ro/iptables_fshark2_portfwd.conf file looks like the following
Step 7) Confirm IP Tables setting is correct
Output the iptables information
Example output:
Step 8) Confirm access
Point the browser to port 7000 or RDP to port 7001 to confirm FSHARK2 is accessible
Last updated
Was this helpful?