edgeshark, docker vm and DNS resolution

[hellt]

Hi @thediveo
I am writing this with understanding that it might not be the issue with edgeshark, but in hope that your vast linux networking knowledge might shed some light on the problem.

As you know, we have an army of networking folks who use edgeshark with containerlab. It works flawlessly on linux, but there is a quirk I am battling with on MacOS.

Let me explain the setup that I am running.
A MacOS M1 macbook is running a linux/arm64 VM orchestrated by the magnificent orbstack.dev where I am running containers and edgeshark.

When orbstack creates a linux/arm64 VM on macOS it does some magic so that a VM gets a local DNS resolution in the form of <vmname>.orb.local. I have no idea how this resolver works, but the outcome of this is that I can type in my browser http://clab.orb.local:5001 (where clab is the vm hostname) and I get to see the edgeshark UI.

So far so good. The problem starts when I try to start the capture, this is where I get this error:

Error from extcap pipe: time="2024-08-23T10:46:15+02:00" level=error msg="querying targets from GhostWire-on-Packetflix service failed: Get \"http://clab.orb.local:5001/discover/mobyshark\": dial tcp: lookup clab.orb.local on 100.100.100.100:53: no such host"
time="2024-08-23T10:46:16+02:00" level=error msg="cannot contact capture service via websocket: dial tcp: lookup clab.orb.local on 100.100.100.100:53: no such host"
time="2024-08-23T10:46:16+02:00" level=error msg="cannot start capture: dial tcp: lookup clab.orb.local on 100.100.100.100:53: no such host"

Now, 100.100.100.100:53 is the DNS resolver that is set on my macOS and this resolver has no notion of orb.local zone, as expected, since it is a global resolver.
But I wonder why the extcap component does not use the same resolver procedure as, say, ping does or a browser, which somehow gets to know that when orb.local zone is concerned, it needs to be resolved not via a global DNS resolver.

Apologies if this is all not related to edgeshark at all =(

PS1: I remember that you're not a macOS user, but maybe for others who would want to dive deeper into the orbstack ways of doing networking for their machines this article might be useful https://docs.orbstack.dev/architecture#network

PS2: if I add the IP<->name pair to the /etc/hosts on my mac, the extpipe program is able to resolve the DNS name just fine.
Maybe as a workaround I will have to do that manual static hosts entry each time I provision a new VM if there are no better alternatives.

[thediveo]

just a quick note, .local is mDNS specific ... and this seem to fit into your observations. The extcap uses the libc-free DNS Go resolver so this also seems to fit into the picture. For macos we might use the system resolver instead, need to look into this.

[hellt]

oh, this seems to fit in the picture precisely. For my understanding, is it the cshargextcap component that does this IP lookup (and fails to do that)?

[thediveo]

The lookup und control establishment is most probably in the csharg module; cshargextcap is "just" the Wireshark adapter.