How to install TCPDUMP package in Aria Operations

Products

• VMware Aria Suite

Issue/Introduction

Installation of TCPDUMP package in Aria Operations node(s).

 

TCPDUMP package is not installed by default due to product security requirements.
To help with troubleshooting, TCPDUMP package can be temporarily installed.

 

When trying to install TCPDUMP package via DNF by running tdnf install tcpdump, we get the error below:

tcpdump package not found or not installed
Error(1011) : No matching packages

Environment

Aria Operations 8.x

Photon OS 3.0, 4.0, 5.0

Resolution

To check the version and release details of Photon OS, execute below commands on Aria Operations node(s) to get the information: 

• Check release: cat /etc/vmware/.buildInfo | grep RELEASE
• Check Photon OS Version: cat /etc/photon-release

 

Pre-requisites:

• Required to have root access on Aria Operations appliance.
• Required to have internet access on the node(s).

 

Note: It is important to uninstall this utility after using it, for security concerns and to prevent any potential issues with upgrades and/or security scans.

 

 

Procedure to install TCPDUMP package:

• For Photon 3.0:

wget https://packages.vmware.com/photon/3.0/photon_updates_3.0_x86_64/x86_64/tcpdump-4.99.4-2.ph3.x86_64.rpm -P /tmp
rpm -i --nodeps /tmp/tcpdump-4.99.4-2.ph3.x86_64.rpm
tcpdump --version

• For Photon 4.0:

wget https://packages.vmware.com/photon/4.0/photon_updates_4.0_x86_64/x86_64/tcpdump-4.99.4-2.ph4.x86_64.rpm -P /tmp
rpm -i --nodeps /tmp/tcpdump-4.99.4-2.ph4.x86_64.rpm
tcpdump --version

• For Photon 5.0:

wget https://packages.vmware.com/photon/5.0/photon_updates_5.0_x86_64/x86_64/tcpdump-4.99.4-3.ph5.x86_64.rpm -P /tmp
rpm -i --nodeps /tmp/tcpdump-4.99.4-3.ph5.x86_64.rpm
tcpdump --version

 

 

Procedure to use the installed TCPDUMP package to perform network packet capture:

tcpdump -i <interface_name> -w <file_name.pcap>

Example: tcpdump -i eth0 -w /tmp/example.pcap

 

 

Procedure to uninstall TCPDUMP package:

• Log into the desired node as root via SSH or Console.
• Run the following command to uninstall tcpdump:
  

  rpm -e tcpdump

Additional Information

How to check Release and Photon OS Version on Aria Operations