GarkTank — watching packets

A packet viewer for WebGen. Pick an interface, watch traffic arrive, filter it, and open any packet down to the bytes. Underneath it is tshark, so the protocol knowledge is Wireshark's.

Install

sudo wgpkg install garktank

That pulls in wireshark as well — the command-line half: tshark, dumpcap, sharkd, editcap, capinfos and dftest. There is no Qt on WebGen and none is needed; the graphical part is GarkTank.

Opening a capture

Open a .pcap or .pcapng from the folder button, or from a terminal:

garktank capture.pcapng

Reading a file needs no privileges at all. If you have been sent a capture, or copied one off another machine, it opens as your ordinary user.

Capturing live

Choose an interface and press Start. The picker says what each device is, which matters more than it sounds: on a machine running VMs you will see the physical NIC alongside bridges (br-lab) and per-VM taps (wgtap0), and choosing the wrong one is the difference between watching a guest's traffic and watching your own.

any captures on every interface at once — the right first choice when you are not yet sure where the traffic is.

Capture writes a real .pcapng under ~/.cache/garktank/, which is what makes packet detail available while the capture is still running.

Privileges

Only dumpcap ever touches an interface, and the package gives it the capabilities to do so, restricted to the wheel group:

getcap /usr/bin/dumpcap
/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip

GarkTank never runs tshark as root. That split is Wireshark's own design and worth keeping: the dissectors are a very large amount of code whose whole job is parsing hostile input, so they run unprivileged.

Filters — the one thing everybody gets wrong once

The filter box takes display filters, the same syntax as Wireshark's:

http                     a bare protocol name is a valid filter
tcp.port == 80           field == value
ip.addr == 192.168.1.200
dns or tls

These are not capture filters. A capture filter is BPF and looks like port 80 — terse, no ==. Writing port==80 mixes the two and is invalid in both. GarkTank v1 uses display filters only.

The box validates as you type using dftest, and shows the parser's own message, which names the offending token. On a system without dftest it says the filter is unchecked rather than marking it wrong.

Reading a packet

Select a row. Detail shows the decode tree — every field the dissectors recognised, nested by protocol layer. Bytes shows the raw frame as hex and ASCII.

Watching a VM's traffic

This is the case GarkTank was built for. With a virtual network from Virtual Machines, each guest has a tap device on a bridge:

webgen-vmnet list
lab            br-lab     10.77.1.0/24       gw 10.77.1.1       up

• Capture on br-lab to see all traffic on that virtual network, including guest-to-guest.
• Capture on a single wgtapN to see one guest's traffic only.
• Capture on the physical NIC to see it after NAT, with the host's address.

What it does not do

GarkTank is a viewer, not a replacement for Wireshark. There are no IO graphs, no statistics dialogs, no expert info, no decode-as, and no custom dissectors. If you need those, the capture file opens in Wireshark on any other machine — it is an ordinary .pcapng.