telecom • networking • design

an EventHelix.com blog


Leave a comment

Visualize and Diagnose Wireshark PCAP Files with Sequence Diagrams

Introducing VisualEther Protocol Analyzer 6.1. Diagnose and debug Wireshark logs with sequence diagrams. Convert PCAP files into sequence diagrams and call flow diagrams by just defining the message fields that should be included in the diagrams. VisualEther takes of the rest, generating a well formatted sequence diagram. You can click on individual messages in the sequence diagram to see field level details.

VisualEther 6.1 adds the following features:

  • Full IPv6 Support
  • Convert any custom protocol to sequence diagrams. Fully customize the diagram generation.
  • Display message details as an expandable list.
  • Added support for Wifi and Ethernet frames

Wireshark to sequence diagrams

Visually debug protocol interactions

sequence-diagram-wireshark

Generate sequence diagrams and call flow diagrams from Wireshark output. The sequence diagrams provide a visual trace of the packet flow between different nodes.

Use regular expressions to identify and flag error scenarios. Messages reporting session failure can be bookmarked in a PDF file, thus giving you quick access to the cause of failure. Protocol experts can identify the error scenarios upfront to speed up protocol debugging.

Summarize Wireshark output…

Wireshark Extraction Template

Define templates to select messages and the fields to be included in the generated diagrams. VisualEther analyzes the Wireshark output to generate documents that match the defined template. The template is defined as a simple XML file.

Support for IPv4, IPv6, Ethernet and Wifi is built in. TCP, UDP and SCTP transport layer support is also available out of the box.

You can customize the templates for any protocol that has an Wireshark dissector. Any custom source and destination addresses can be used to define the sequence diagram instance axes.

…while maintaining full message detail

Wireshark message shown in full detail.

Click on any message in PDF sequence diagrams. VisualEther shows you complete field level details of that message in a browser window.

The message nodes can be expanded and collapsed. This way you can focus on the part of the message that interests you.

Reverse engineer system design

Reverse engineer design from Wireshark

Reverse engineering system design by analyzing the message flow in an operational system. Design documents are generated from the Wireshark traces. The generated documents can be edited and reformatted using EventStudio System Designer.

Automate diagram generation from Wireshark PCAP Files

Wireshark to sequence diagram generation script

Automate capture of Wireshark logs with tshark and then use the VisualEther command-line mode to generate sequence diagrams and context diagrams.

Explore more

Advertisements


4 Comments

Sequence diagrams from Wireshark PCAP files

Announcing the release of VisualEther Protocol Analyzer 6.0.015 release.

VisualEther - Wireshark to Sequence Diagram Generation

  • Automate sequence diagram generation from the PCAP files with the built in command-line support. VisualEther can now be invoked from a script.
  • Built in support for Wi-Fi and Ethernet messages
  • Simplified message field analysis with collapsible message definition
  • Improved filtering to weed out repeated packets like RTP packets and broadcast messages.
  • Full support for .cap, .pcap, .pcapng and their .gz counterparts
  • Improved bookmarking for important messages. Bookmarked messages are appear in the bookmark pane of your PDF reader.
  • Improved processing for large PCAP files. VisualEther now automatically splits large files.
  • Reduced memory footprint in sequence diagram generation

Introducing VisualEther Protocol Analyzer 6

Generate Sequence Diagrams from Wireshark PCAP files

visually debug protocol interactions

Generate sequence diagrams and context diagrams from Wireshark output. The sequence diagrams provide a visual trace of the packet flow between different nodes. The collaboration diagrams give a birds-eye-view of the protocol interactions.

Sequence diagram generated from Wireshark PCAP file

summarize Wireshark output…

Templates for identifying Wireshark messages that should be included in the sequence diagram.

Define templates to select messages and the fields to be included in the generated diagrams. VisualEther analyzes the Wireshark (Ethereal) output to generate documents that match the defined template. The template is defined as a simple XML file.


…while maintaining full message detail

Click on any message in PDF sequence diagrams. VisualEther shows you complete field level details of that message in a browser window.

Click on any message in the sequence diagram to see full message details.

reverse engineer system design

wireshark to message sequence chart generation template

Reverse engineering system design by analyzing the message flow in an operational system. Design documents are generated from the Wireshark traces. The generated documents can be edited and reformatted using EventStudio System Designer.


Leave a comment

What’s New in EventStudio System Designer 6

Introducing EventStudio System Designer 6. A free 45 day trial is available for download.

New features in the release:

Message endpoint tagging

Specify tags

Tag the message source and destinations. This can be used to identify the endpoint port numbers, and specify the protocol layer or software entities.

“BSSMAP PAGING”: A-bssmap -> B-bssmap
HTTPGet : Client -> Server-“80”
Cascade : A-rr -> B-cc -> C-“80”
A-bcch multicasts SI to B-bcch, C-bcch
Cascade : A-cc -> B-cc -> C-rr
chain
Chain1(par1,param2,param3):A-cc-> B-cc
Chain2: B-cc -> C-rr
endchain

Style tags

Each type of tag can be individually formatted. The color, font and font size may be specified. The styles for tags should be named as <tag>_tag_style. A few examples are shown below:

style rr_tag_style: color=RED, bgcolor=RED, textcolor=WHITE
style sccp_tag_style: color=DODGERBLUE, bgcolor=DODGERBLUE, textcolor=WHITE
style isup_tag_style: color=GREY, bgcolor=GREY, textcolor=WHITE
style bssmap_tag_style: color=MIDNIGHTBLUE, bgcolor=MIDNIGHTBLUE, textcolor=WHITE
style cc_tag_style: color=DARKSLATEGRAY, bgcolor=DARKSLATEGRAY, textcolor=WHITE
style bcch_tag_style: color=DODGERBLUE, bgcolor=DODGERBLUE, textcolor=WHITE
style “80_tag_style”: color=DODGERBLUE, bgcolor=DODGERBLUE, textcolor=WHITE

Tag specific diagrams

Use tags to filter and generate sequence diagrams that just contain messages with a specific tag.

Styling

Control the look and feel of documents with default styles. Automatically apply these styles that match regular expressions. For example, specify a style for all messages that start with specific text. Styles have been enhanced to change colors for the background, text, and parameters.

Group interactions with sequences

Simplified sequence definitions

Grouping interactions has been simplified. Just enclose the interactions in a sequence statement. EventStudio automatically identifies the interacting entities.

Nest sequences

Sequences may be nested. Quickly access a sequence from a PDF bookmark, which are nested too.

Collapse sequences

Complete sequences are shown the first time they occur in a sequence diagram. Subsequent occurrences of the sequence are shown as a simple clickable box. Clicking on the box takes the user to the expanded sequence.
module: Module_01
component: Component_01 in Module_01
eternal: a in Component_01, b in Component_01, c in Component_01
feature "Sequence Grouping"
  sequence "Call Setup"
     IAM : a -> b
     b takes action "Check digits"
     ACM : a <- b
  endsequence
  case
     leg "Called Party Free":
       a, b take action "Set up the  voice path"
     leg "Called Party Busy": 
       a, b take action "Feed busy tone"
  endcase
  sequence "Call Release"
     REL : a -> b
     RLC : a <- b
  endsequence
endfeature

Classify systems with 5 levels of hierarchy

Generate sequence diagrams at any of the five abstraction levels.

Developers may work at the component and object level. System architects analyze the design at a system and subsystem level.

Improved modeling

Actions

Actions, which have a distinct beginning and ending, can be modeled with the new continuous action support. Also, actions may be specified at different levels in the hierarchy.

Messages

Lost messages can be modeled in sequence diagrams. Additionally, messages can be represented through a single simple statement.

“Lost Message”: A ->X B
“Message Cascade”: A -> B -> C

Enhanced tracing support

Flexible object interactions

Method invocation rules have been relaxed to make them compatible with sequence diagram generation from trace messages (http://eventhelix.github.com/trace-to-sequence-diagram/). Method calls to caller classes are permitted.

Command line

Command line mode is used to generate sequence diagrams from scripts. The command line can now be customized with specific conditional defines and include paths.

Model large systems

Share instance axes

Large number of interacting entities need not result in a large number of axis in diagrams. Dynamic objects can share a single instance axis, thus reducing the total number of axes needed in a sequence diagram.

Really large sequence diagrams

Sequence diagrams can now run into hundreds of pages. This is useful when converting large trace documents to sequence diagrams.

XML export

Export scenarios and interactions to XML. This enables generation of custom diagrams and documents.