capture process failure: websocket: close sent

Hi,

I've been trying to get captures working with no luck and not much to go on.

I've got the edgeshark and gostwire containers up and running. The web ui works, I can access it on http://ip:5001. I've also got the wireshark extension and the external interfaces are shown, the mobyshark one fetches the containers properly too.

However, anytime I try to start a capture, wireshark immediately just ends up in this state.

There are only 2 errors that I've seen, the first is in the edgeshark container logs (i've enabled debug logs to try and troubleshoot). This happens every time I try to start a capture.

DEBU[2023-11-17T12:55:16Z] (pleasant-calf) /capture URL path handler started...
DEBU[2023-11-17T12:55:16Z] (pleasant-calf) beginning websocket upgrade...
DEBU[2023-11-17T12:55:16Z] (pleasant-calf) websocket upgrade successful
DEBU[2023-11-17T12:55:16Z] (pleasant-calf) updating container meta data from local discovery service (at port 5000)
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) updating information about docker edgeshark
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) docker to capture from: api.Target{Name:"edgeshark", Type:"docker", NetNS:4026532514, NetworkInterfaces:[]string{"eth0", "lo"}, Prefix:"", StartTime:3429142349, Pid:23249, NodeName:"", Cluster:(*api.Cluster)(nil), CaptureService:"", CapturePort:0}
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capturing from docker network interfaces: eth0, lo
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) referencing netns:[4026532514] as "/proc/23249/ns/net"
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) starting capture command...
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) running /usr/bin/dumpcap inside locked net:[4026532514]
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) watching websocket connection...
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture process: Capturing on 'eth0' and 'Loopback: lo'
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture process: File: -
DEBU[2023-11-17T12:55:17Z] section in packet capture stream is little endian
DEBU[2023-11-17T12:55:17Z] section header block: version 1.0
DEBU[2023-11-17T12:55:17Z] signalled unknown section length
DEBU[2023-11-17T12:55:17Z] option type 2: "Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz (with SSE4.2)"
DEBU[2023-11-17T12:55:17Z] option type 3: "Linux 5.10.28-Unraid"
DEBU[2023-11-17T12:55:17Z] option type 4: "Dumpcap (Wireshark) 4.0.10 (Git commit f5c7c25a81eb)"
DEBU[2023-11-17T12:55:17Z] creating fresh SHB comment with container meta information
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture client closing with code 1000, reason "ciao"
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) acknowledging close (ciao!)
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) signalling capture process to terminate...
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) websocket closed
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture process: Packets captured: 0
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture process: Packets received/dropped on interface 'eth0': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture process: Packets received/dropped on interface 'Loopback: lo': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)
DEBU[2023-11-17T12:55:17Z] websocket broken: websocket: close sent
DEBU[2023-11-17T12:55:17Z] pcapng stream broken: websocket: close sent
ERRO[2023-11-17T12:55:17Z] (pleasant-calf) capture process failure: websocket: close sent
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) /capture handler finished after 0:00:00

The gostwire container has a warning and error but they don't happen when I start a capture, so unsure if relevant:

WARN[2023-11-17T12:33:00Z] master network interface is not a bridge, but of type 'bond'
INFO[2023-11-17T12:33:00Z] found 6 Docker networks related to net:[4026531992] ⚙️  init(1), …
ERRO[2023-11-17T12:33:00Z] cannot resolve CNI plugins configuration path, reason: lstat /proc/20847/root/etc/cni: no such file or directory

In the UI, clicking the wireshark button does nothing, I've tried to copy the link behind it to use it with the packetflix interface in wireshark and got the exact same result as above.

The host with docker is an unraid system and the client with wireshark is osx. Not sure what other information would be useful for you, but happy to provide.

I'm not sure where to go from here, so any help would be appreciated.

Immediately after posting it, I tried it on a windows machine and the capture works there, so I'm assuming the issue is either an osx setting or the osx wireshark extension. I'm going to close the issue since I can move on, but if you're interested in fixing it I'm happy to work with you to troubleshoot why it doesn't work on the OSX client.

Hi @mitom, thank you for the helpful bug report!

From the screenshot I guess that you're on an Apple/Darwin system: one-click capture start from the web UI unfortunately doesn't work on Darwin. As my limited understanding of the Darwin platform goes, the registration of URL scheme handlers is very different from Windows and Linux. Unfortunately, I don't have a Darwin system at hand, but the large road block for me is that I have absolutely zero working knowledge in these Darwin areas. I would be very thankful for a Darwin PR in this area...
There's still the "Docker host capture" plugin available to you: start Wireshark and it should be listed in addition to the packetflix extcap. Make sure to specify the Edgeshark service endpoint using HTTP, not HTTPS.

regarding logs: the packetflix logs indicate that the websocket session was successfully established, and then terminated by the client:

DEBU[2023-11-17T12:55:17Z] (pleasant-calf) capture client closing with code 1000, reason "ciao"
DEBU[2023-11-17T12:55:17Z] (pleasant-calf) acknowledging close (ciao!)

This, in combination with other log messages let me suspect a problem on the client/plugin side.

The cshargextcap plugin binary can be instructed via an environment variable CSHARK_LOG (yes, that one still spells "shark" correctly) to log its invocations to a file. Can you please set CSHARK_LOG to a path/filename of a logging file in your system so that the plugin picks it up when run by Wireshark? The file does not need to exist, it will be created automatically. Hopefully, this can give more insight.

regarding WARN[2023-11-17T12:33:00Z] master network interface is not a bridge, but of type 'bond': now that's an interesting one 😁 I need to ponder about and probably ask for more details later. This looks like I need to add bonding topology discovery support to G(h)ostwire. That should be hopefully easy to mock with dummy network interfaces, as this would allow easy unit testing.

I wonder if my pipe break checking for Darwin is broken and immediately falsely triggers; the code is in https://github.com/siemens/cshargextcap/blob/main/pipe/checker_notwin.go

Hi @thediveo - I didn't get notifications after the issue was closed I think, sorry for the delay.

I have tried to set the env var but it is either ignored or doesn't do anything - or maybe I'm meant to set it in a different way?

export CSHARK_LOG=/tmp/cshark.log
wireshark
 ** (wireshark:51463) 14:10:54.673148 [Capture MESSAGE] -- Capture Start ...
 ** (wireshark:51463) 14:10:55.377004 [Capture MESSAGE] -- Capture started
 ** (wireshark:51463) 14:10:55.377111 [Capture MESSAGE] -- File: "/var/folders/8b/mj328b7x4v56rjlkm81vc40h0000gn/T/wireshark_Docker host capture (0.9.8)O2NXE2.pcapng"
 ** (wireshark:51463) 14:10:55.410346 [Capture MESSAGE] -- Capture stopped.
 ** (wireshark:51463) 14:10:55.410377 [Capture WARNING] ui/capture.c:722 -- capture_input_closed():
^C
cat /tmp/cshark.log
[bat error]: '/tmp/cshark.log': No such file or directory (os error 2)

Is that the correct way to set it or is it meant to be somehow set explicitly for the plugin?

@mitom you're doing everything correctly; I've found and fixed the bug in the cshargextcap CLI and just released new packages. This time, you should get your CSHARK_LOG env var correctly getting picked up and a log written as you go.

@thediveo great - I was able to get the log with it (I have removed the names of a few containers - the xxx ones - but they did pick up correctly.).

[13:14:45] DEBUG cshargextcap version 0.9.9
[13:14:45] DEBUG extcaps: mobyshark, packetflix
[13:14:45] DEBUG arg: "--extcap-interfaces"
[13:14:45] DEBUG arg: "--extcap-version=4.2"
[13:14:45] DEBUG proxy setting: http_proxy=
[13:14:45] DEBUG proxy setting: HTTP_PROXY=
[13:14:45] DEBUG proxy setting: https_proxy=
[13:14:45] DEBUG proxy setting: HTTPS_PROXY=
[13:14:45] DEBUG proxy setting: no_proxy=
[13:14:45] DEBUG proxy setting: NO_PROXY=
[13:14:45] DEBUG executing action --extcap-interfaces
[13:14:45] DEBUG extcap nif: "mobyshark" (Docker host capture)
[13:14:45] DEBUG extcap nif: "packetflix" (packetflix:// remote cluster and container host capture)
[13:14:45] DEBUG finished with status code 0
[13:14:45] DEBUG cshargextcap version 0.9.9
[13:14:45] DEBUG extcaps: mobyshark, packetflix
[13:14:45] DEBUG arg: "--extcap-config"
[13:14:45] DEBUG arg: "--extcap-interface"
[13:14:45] DEBUG arg: "mobyshark"
[13:14:45] DEBUG proxy setting: http_proxy=
[13:14:45] DEBUG proxy setting: HTTP_PROXY=
[13:14:45] DEBUG proxy setting: https_proxy=
[13:14:45] DEBUG proxy setting: HTTPS_PROXY=
[13:14:45] DEBUG proxy setting: no_proxy=
[13:14:45] DEBUG proxy setting: NO_PROXY=
[13:14:45] DEBUG executing action --extcap-configure for interface "mobyshark"
[13:14:45] DEBUG finished with status code 0
[13:14:45] DEBUG cshargextcap version 0.9.9
[13:14:45] DEBUG extcaps: mobyshark, packetflix
[13:14:45] DEBUG arg: "--extcap-config"
[13:14:45] DEBUG arg: "--extcap-interface"
[13:14:45] DEBUG arg: "packetflix"
[13:14:45] DEBUG proxy setting: http_proxy=
[13:14:45] DEBUG proxy setting: HTTP_PROXY=
[13:14:45] DEBUG proxy setting: https_proxy=
[13:14:45] DEBUG proxy setting: HTTPS_PROXY=
[13:14:45] DEBUG proxy setting: no_proxy=
[13:14:45] DEBUG proxy setting: NO_PROXY=
[13:14:45] DEBUG executing action --extcap-configure for interface "packetflix"
[13:14:45] DEBUG finished with status code 0
[13:14:46] DEBUG cshargextcap version 0.9.9
[13:14:46] DEBUG extcaps: mobyshark, packetflix
[13:14:46] DEBUG arg: "--extcap-dlts"
[13:14:46] DEBUG arg: "--extcap-interface"
[13:14:46] DEBUG arg: "mobyshark"
[13:14:46] DEBUG proxy setting: http_proxy=
[13:14:46] DEBUG proxy setting: HTTP_PROXY=
[13:14:46] DEBUG proxy setting: https_proxy=
[13:14:46] DEBUG proxy setting: HTTPS_PROXY=
[13:14:46] DEBUG proxy setting: no_proxy=
[13:14:46] DEBUG proxy setting: NO_PROXY=
[13:14:46] DEBUG executing action --extcap-dlts
[13:14:46] DEBUG DLT #147 (remote container capture)
[13:14:46] DEBUG finished with status code 0
[13:14:46] DEBUG cshargextcap version 0.9.9
[13:14:46] DEBUG extcaps: mobyshark, packetflix
[13:14:46] DEBUG arg: "--extcap-dlts"
[13:14:46] DEBUG arg: "--extcap-interface"
[13:14:46] DEBUG arg: "packetflix"
[13:14:46] DEBUG proxy setting: http_proxy=
[13:14:46] DEBUG proxy setting: HTTP_PROXY=
[13:14:46] DEBUG proxy setting: https_proxy=
[13:14:46] DEBUG proxy setting: HTTPS_PROXY=
[13:14:46] DEBUG proxy setting: no_proxy=
[13:14:46] DEBUG proxy setting: NO_PROXY=
[13:14:46] DEBUG executing action --extcap-dlts
[13:14:46] DEBUG DLT #147 (remote container capture)
[13:14:46] DEBUG finished with status code 0
[13:14:49] DEBUG cshargextcap version 0.9.9
[13:14:49] DEBUG extcaps: mobyshark, packetflix
[13:14:49] DEBUG arg: "--extcap-config"
[13:14:49] DEBUG arg: "--extcap-interface"
[13:14:49] DEBUG arg: "mobyshark"
[13:14:49] DEBUG proxy setting: http_proxy=
[13:14:49] DEBUG proxy setting: HTTP_PROXY=
[13:14:49] DEBUG proxy setting: https_proxy=
[13:14:49] DEBUG proxy setting: HTTPS_PROXY=
[13:14:49] DEBUG proxy setting: no_proxy=
[13:14:49] DEBUG proxy setting: NO_PROXY=
[13:14:49] DEBUG executing action --extcap-configure for interface "mobyshark"
[13:14:49] DEBUG finished with status code 0
[13:14:49] DEBUG cshargextcap version 0.9.9
[13:14:49] DEBUG extcaps: mobyshark, packetflix
[13:14:49] DEBUG arg: "--extcap-config"
[13:14:49] DEBUG arg: "--extcap-interface"
[13:14:49] DEBUG arg: "mobyshark"
[13:14:49] DEBUG proxy setting: http_proxy=
[13:14:49] DEBUG proxy setting: HTTP_PROXY=
[13:14:49] DEBUG proxy setting: https_proxy=
[13:14:49] DEBUG proxy setting: HTTPS_PROXY=
[13:14:49] DEBUG proxy setting: no_proxy=
[13:14:49] DEBUG proxy setting: NO_PROXY=
[13:14:49] DEBUG executing action --extcap-configure for interface "mobyshark"
[13:14:49] DEBUG finished with status code 0
[13:14:53] DEBUG cshargextcap version 0.9.9
[13:14:53] DEBUG extcaps: mobyshark, packetflix
[13:14:53] DEBUG arg: "--extcap-config"
[13:14:53] DEBUG arg: "--extcap-interface"
[13:14:53] DEBUG arg: "mobyshark"
[13:14:53] DEBUG arg: "--extcap-reload-option"
[13:14:53] DEBUG arg: "container"
[13:14:53] DEBUG arg: "--proxyoff=true"
[13:14:53] DEBUG arg: "--dockerhosturl"
[13:14:53] DEBUG arg: "http://10.10.10.90:5001"
[13:14:53] DEBUG arg: "--showcontainers=true"
[13:14:53] DEBUG arg: "--nif"
[13:14:53] DEBUG arg: "any"
[13:14:53] DEBUG proxy setting: http_proxy=
[13:14:53] DEBUG proxy setting: HTTP_PROXY=
[13:14:53] DEBUG proxy setting: https_proxy=
[13:14:53] DEBUG proxy setting: HTTPS_PROXY=
[13:14:53] DEBUG proxy setting: no_proxy=
[13:14:53] DEBUG proxy setting: NO_PROXY=
[13:14:53] DEBUG executing action --extcap-configure --extcap-reload-option "container"
[13:14:53] DEBUG Docker host URL: http://10.10.10.90:5001
[13:14:53] DEBUG discovering targets...
[13:14:53] DEBUG querying targets from GhostWire-on-Packetflix service "http://10.10.10.90:5001/discover/mobyshark", time limit 0s
[13:14:54] DEBUG docker: "xxx" netns:[4026532648] 
[13:14:54] DEBUG docker: "victoria-metrics" netns:[4026533049] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532500] 
[13:14:54] DEBUG docker: "Grafana" netns:[4026532362] 
[13:14:54] DEBUG proc: "init(1)" netns:[4026531992] 
[13:14:54] DEBUG docker: "xxx" netns:[4026533187] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532571] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532571] 
[13:14:54] DEBUG docker: "vpn" netns:[4026532571] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532853] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532570] 
[13:14:54] DEBUG docker: "cadvisor" netns:[4026532280] 
[13:14:54] DEBUG docker: "edgeshark" netns:[4026533325] 
[13:14:54] DEBUG docker: "gostwire" netns:[4026533257] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532431] 
[13:14:54] DEBUG docker: "xxx" netns:[4026533118] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532717] 
[13:14:54] DEBUG proc: "sh(25481)" netns:[4026532726] 
[13:14:54] DEBUG docker: "traefik" netns:[4026532726] 
[13:14:54] DEBUG docker: "xxx" netns:[4026532922] 
[13:14:54] DEBUG finished with status code 0
[13:15:02] DEBUG cshargextcap version 0.9.9
[13:15:02] DEBUG extcaps: mobyshark, packetflix
[13:15:02] DEBUG arg: "--extcap-config"
[13:15:02] DEBUG arg: "--extcap-interface"
[13:15:02] DEBUG arg: "mobyshark"
[13:15:02] DEBUG proxy setting: http_proxy=
[13:15:02] DEBUG proxy setting: HTTP_PROXY=
[13:15:02] DEBUG proxy setting: https_proxy=
[13:15:02] DEBUG proxy setting: HTTPS_PROXY=
[13:15:02] DEBUG proxy setting: no_proxy=
[13:15:02] DEBUG proxy setting: NO_PROXY=
[13:15:02] DEBUG executing action --extcap-configure for interface "mobyshark"
[13:15:02] DEBUG finished with status code 0
[13:15:02] DEBUG cshargextcap version 0.9.9
[13:15:02] DEBUG extcaps: mobyshark, packetflix
[13:15:02] DEBUG arg: "--extcap-config"
[13:15:02] DEBUG arg: "--extcap-interface"
[13:15:02] DEBUG arg: "mobyshark"
[13:15:02] DEBUG proxy setting: http_proxy=
[13:15:02] DEBUG proxy setting: HTTP_PROXY=
[13:15:02] DEBUG proxy setting: https_proxy=
[13:15:02] DEBUG proxy setting: HTTPS_PROXY=
[13:15:02] DEBUG proxy setting: no_proxy=
[13:15:02] DEBUG proxy setting: NO_PROXY=
[13:15:02] DEBUG executing action --extcap-configure for interface "mobyshark"
[13:15:02] DEBUG finished with status code 0
[13:15:02] DEBUG cshargextcap version 0.9.9
[13:15:02] DEBUG extcaps: mobyshark, packetflix
[13:15:02] DEBUG arg: "--capture"
[13:15:02] DEBUG arg: "--extcap-interface"
[13:15:02] DEBUG arg: "mobyshark"
[13:15:02] DEBUG arg: "--fifo"
[13:15:02] DEBUG arg: "/var/folders/8b/mj328b7x4v56rjlkm81vc40h0000gn/T/wireshark_extcap_mobyshark_TJXFF2/fifo"
[13:15:02] DEBUG arg: "--nif"
[13:15:02] DEBUG arg: "any"
[13:15:02] DEBUG arg: "--showcontainers"
[13:15:02] DEBUG arg: "--dockerhosturl"
[13:15:02] DEBUG arg: "http://10.10.10.90:5001"
[13:15:02] DEBUG arg: "--container"
[13:15:02] DEBUG arg: "%7B%22name%22%3A%22Grafana%22%2C%22type%22%3A%22docker%22%2C%22netns%22%3A4026532362%2C%22network-interfaces%22%3A%5B%22lo%22%2C%22eth0%22%5D%2C%22prefix%22%3A%22%22%2C%22starttime%22%3A3513122541%2C%22pid%22%3A20298%2C%22node-name%22%3A%2210.10.10.90%22%7D"
[13:15:02] DEBUG arg: "--proxyoff"
[13:15:02] DEBUG proxy setting: http_proxy=
[13:15:02] DEBUG proxy setting: HTTP_PROXY=
[13:15:02] DEBUG proxy setting: https_proxy=
[13:15:02] DEBUG proxy setting: HTTPS_PROXY=
[13:15:02] DEBUG proxy setting: no_proxy=
[13:15:02] DEBUG proxy setting: NO_PROXY=
[13:15:02] DEBUG executing action --capture for interface "mobyshark"
[13:15:02] DEBUG Docker host URL: http://10.10.10.90:5001
[13:15:02] DEBUG fifo to Wireshark /var/folders/8b/mj328b7x4v56rjlkm81vc40h0000gn/T/wireshark_extcap_mobyshark_TJXFF2/fifo
[13:15:02] DEBUG capturing from: "docker" "Grafana"
[13:15:02] DEBUG capturing from network interfaces: any
[13:15:02] DEBUG skipping unneeded target discovery
[13:15:02] DEBUG connecting to capture service "ws://10.10.10.90:5001/capture?container=%7B%22name%22%3A%22Grafana%22%2C%22type%22%3A%22docker%22%2C%22netns%22%3A4026532362%2C%22network-interfaces%22%3A%5B%22lo%22%2C%22eth0%22%5D%2C%22prefix%22%3A%22%22%2C%22starttime%22%3A3513122541%2C%22pid%22%3A20298%2C%22node-name%22%3A%2210.10.10.90%22%7D&nif=any", time limit 0s
[13:15:02] DEBUG capture service initial HTTP response: {Status:101 Switching Protocols StatusCode:101 Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[Connection:[Upgrade] Sec-Websocket-Accept:[cNxJO3uyz9E2r25bufs9wSNM090=] Upgrade:[websocket]] Body:{Reader:0x14000117d40} ContentLength:0 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x14000102900 TLS:<nil>}
[13:15:02] DEBUG capturing from: docker Grafana
[13:15:02] DEBUG capturing from network interfaces: lo, eth0
[13:15:02] DEBUG constantly monitoring packet capture fifo status...
[13:15:02] DEBUG section in packet capture stream is little endian
[13:15:02] DEBUG section header block: version 1.0
[13:15:02] DEBUG signalled unknown section length
[13:15:02] DEBUG option type 1: "---
# capture target information
container-name: Grafana
container-type: docker
node-name: 10.10.10.90
"
[13:15:02] DEBUG option type 2: "Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz (with SSE4.2)"
[13:15:02] DEBUG option type 3: "Linux 5.10.28-Unraid"
[13:15:02] DEBUG option type 4: "Dumpcap (Wireshark) 4.0.10 (Git commit f5c7c25a81eb)"
[13:15:02] DEBUG removing existing SHB comment with container meta information, then updating
[13:15:02] DEBUG capture fifo broken, stopped monitoring.
[13:15:02] DEBUG initiating graceful websocket close
[13:15:02] DEBUG waiting for graceful close to be finished...
[13:15:02] DEBUG server acknowledged websocket close
[13:15:02] DEBUG websocket packet data stream error: websocket: close 1000 (normal)
[13:15:02] DEBUG packet capture stopped
[13:15:02] DEBUG websocket gracefully closed.
[13:15:02] DEBUG waiting for graceful close to be finished...
[13:15:02] DEBUG websocket gracefully closed.
[13:15:02] DEBUG finished with status code 0

Thank you very much for the log! It confirms my suspicion with the capture fifo (pipe) handling between Wireshark and the extcap plugin, but unfortunately I don't know what exactly isn't working as expected.

[13:15:02] DEBUG capture fifo broken, stopped monitoring.
[13:15:02] DEBUG initiating graceful websocket close
[13:15:02] DEBUG waiting for graceful close to be finished...

I suspect that the Select reporting differs on Darwin compared to Linux, but I don't have a Darwin system I could test and drill down into this issue.

Would it be possible to run the unit test just on the pipe package, that is, after cloning the cshargextcap repo and in its top-level directory, run a go test -v ./pipe?

Looks like it passes.

go test -v ./pipe

go: downloading github.com/onsi/gomega v1.30.0
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading golang.org/x/sys v0.14.0
go: downloading github.com/onsi/ginkgo/v2 v2.13.1
go: downloading github.com/thediveo/success v1.0.2
go: downloading github.com/go-logr/logr v1.3.0
go: downloading golang.org/x/net v0.18.0
go: downloading github.com/google/go-cmp v0.6.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading golang.org/x/text v0.14.0
=== RUN   TestContainerSharkExtCap
Running Suite: cshargextcap/pipe - /Users/mitom/projects/cshargextcap/pipe
==========================================================================
Random Seed: 1701181812

Will run 1 of 1 specs
time="2023-11-28T14:30:12Z" level=debug msg="constantly monitoring packet capture fifo status..."
time="2023-11-28T14:30:14Z" level=debug msg="capture fifo broken, stopped monitoring."
•

Ran 1 of 1 Specs in 2.002 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
--- PASS: TestContainerSharkExtCap (2.00s)
PASS
ok      github.com/siemens/cshargextcap/pipe    2.184s

While it doesn't help fixing it, I've tried replacing https://github.com/siemens/cshargextcap/blob/main/capturestream.go#L73 with just a sleep and with that I am able to capture packets as long as the sleep is running - so the issue is definitely there.

I've also tested that the condition in https://github.com/siemens/cshargextcap/blob/main/pipe/checker_notwin.go#L35 that ends it is the n != 0, rather than there being an err.

I'm not really all that familiar with Go so the rest of it is a bit cryptic for me but I'll try to debug it more a bit later.

@thediveo I've not really gotten anywhere with this.

I've tried to mess around with the way the descriptor is passed in but the only thing I concluded is any lower number than the actual descriptor hangs it and any higher breaks the check (which makes the capturing work, same as if we just didn't do this check).

Also tried adding in some delays before the first check just in case it's some sort of race condition, which gives a few seconds of capture until the check runs once and then the same thing happens so that's also not it.

Basically, the code seems fine to me and I'd assume the issue would be some behaviour of wireshark being different than what it expects. I have no idea how to approach that unfortunately.

If you have any ideas to try I'll give it a go, but not sure where to go from here.

@mitom thank you very much for taking the time to look into it, this is highly appreciated!

If you specify a lower number of fds to select, then the detection should never trigger, as the interesting pipe fd is excluded.
If you specify a higher number of fds to select, this shouldn't hurt. Now what catches my eye is that you write that passing a higher number of fds make the capture work (with the break detection probably failing, but anyway). But I don't yet see how this might point to the mistaken assumptions in my code though.

The return value n should be 1; if I understand the Darwin man pages correctly, n can be -1 in case of an error (but maybe the Golang stdlib changes n in case of errors).

@thediveo Sorry - I hadn't have a chance a to respond.

As above given that the capture works with the check commented out, the higher fd basically achieves the same I believe.

To expand why I think the issue is some other circumstance that's not in the code is because the test seems correct to me, and that works as expected too. Hence my assumption that either wireguard does something that makes this pipe appear closed to the code or maybe it's the wrong pipe to check (although I think in this case the capture wouldn't work either based on the code). Not sure, I certainly don't have any smoking guns - just an assumption.

I've not had any ideas to try to go further on this, and unless we have some sort of new steps to try I'll probably leave it as is. Thank you for trying to resolve it and in general for the project.

If you do have something you'd like me to try feel free to let me know though!

Thank you very much anyway! I've now asked about potential differences in Wireshark/Darwin in the Wireshark developer discord channel.

Just to have this information ready: which version of Wireshark are you using?

I will keep this issue open; hopefully we still find the solution.

I am using 4.2.0, the macos arm version.

I've now got my fingers on an Intel-based MacBook and am trying to drill into this perplexing issue.

At least I seem to now be able to reproduce the issue also in the unit test -- the unit test has used an os.Pipe instead of a named pipe using unix.Mkfifo and I can trigger the readable situation on the write end by writing some data into the write end (sic!), thus prematurely terminating the pipe watch. I still don't understand what is wrong, but at least the test now reproduces the situation and macos, yet passes as observed so far on Linux.

That sounds like pretty good progress!

well, it's still unclear why the unix.Select behavior differs on macos; an attempt using unix.Poll is yet unsuccessful, so I'm stilling trying to figure out where the bug is.

I just tried this software today and ran into same problem using M1 mac. But...I got some good news I think? After reading through the posts here I figured I'd give a go (pun intended) at building the executable myself, trying it out, then seeing if I could maybe just ignore errors for now 😎 . Turns out, just building it on my mac fixed it! I can now see packet captures for all containers.

FYI my build process was simply:

clone the repo (https://github.com/siemens/cshargextcap.git)
check out branch "macos" (commit 7fa651f2212f61318f13e15996e5616a00eaa799)
use vscode devcontainer image mcr.microsoft.com/devcontainers/go:1-1.21-bullseye (no other mods to conf needed)
run "make dist", it fails trying to do windows things, but darwin executable is created
download "dist/default_darwin_arm64/cshargextcap" and put in wireshark extcap dir

Not sure what that means for your build pipeline, but hope this helps in some way!

Ah, I just noticed macos branch was updated two days ago using poll. Based on your last comment @thediveo, is it unexpected to work? Either way glad it did lol. Many thanks for that.

The macos branch is experimental. At the moment, we can reproduce the issue, but we haven't yet any fix for it. We also did not get a unix.Poll version working either. Would it be possible for you to have a closer look at the pipe break checker in the pipe/ folder/package?

Oh, you can manually build an executable using go build -tags netgo,osusergo ./pipe and then move the resulting cshargextcap into the extcap folder inside the Wireshark app. However, atm this won't work correctly due to the open issue with pipe break detection.

@baileys-am ... wait, it does work for you?? can you please run the unit test using go test -v ./pipe -ginkgo.v and post the result? Which macos version and which go version do you use? I'm asking because I don't get it working on an Intel macbook pro with macos 12.something...

YES! It does work for me (only using the build I did myself on the mac). And yes, that test passes for me.

vscode ➜ /workspaces/cshargextcap (macos) $ go test -v ./pipe -ginkgo.v
=== RUN   TestContainerSharkExtCap
Running Suite: cshargextcap/pipe - /workspaces/cshargextcap/pipe
================================================================
Random Seed: 1702846461

Will run 1 of 1 specs
------------------------------
pipes detects on the write end when a pipe breaks
/workspaces/cshargextcap/pipe/checker_notwin_test.go:20
  STEP: creating a temporary named pipe/fifo and opening its ends @ 12/17/23 20:54:21.333
  STEP: waiting for pipe to break @ 12/17/23 20:54:21.345
time="2023-12-17T20:54:21Z" level=debug msg="constantly monitoring packet capture fifo status..."
  STEP: continously draining the read end of the pipe into /dev/null @ 12/17/23 20:54:21.345
  STEP: writing some data into the pipe @ 12/17/23 20:54:21.346
  STEP: closing read end of pipe @ 12/17/23 20:54:23.346
  STEP: pipe draining done @ 12/17/23 20:54:23.347
time="2023-12-17T20:54:23Z" level=debug msg="poll: [{Fd:7 Events:9 Revents:8}]"
time="2023-12-17T20:54:23Z" level=debug msg="capture fifo broken, stopped monitoring."
• [2.014 seconds]
------------------------------

Ran 1 of 1 Specs in 2.015 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
--- PASS: TestContainerSharkExtCap (2.02s)
PASS
ok      github.com/siemens/cshargextcap/pipe    2.023s

I'm using a M1 Pro with Ventura 13.6.2

@baileys-am sadly, we cannot reproduce this on our macos Macbooks (Intel w/ 12.7.x; Intel w/ 13.x; ARM w/ 13.x). We additionally tried this to reproduce on an Intel macbook using the devcontainer you listed, building the unit test using GOOS=darwin GOARCH=amd64 go test -v -tags netgo,osusergo -c ./pipe and then downloading the resulting pipe.test and running it. In all cases, we got the unit test failing as it runs into the timeout that is now used in the improved unit test (the unit test passes okay on Linux though). This is totally dazzling.

@thediveo that's frustrating. I just attempted to run the pipe.test per

using the devcontainer you listed, building the unit test using GOOS=darwin GOARCH=amd64 go test -v -tags netgo,osusergo -c ./pipe and then downloading the resulting pipe.test and running it.

It hangs. Not sure if it's helpfull, but I'll put the output below after sending a CTRL+C.

Just to clarify, previously you asked if I could run go test -v ./pipe -ginkgo.v, I did so running it in the container. I don't have Go installed on the Mac.

Running Suite: cshargextcap/pipe - Downloads
==============================================================
Random Seed: 1702908133

Will run 1 of 1 specs
DEBU[0000] constantly monitoring packet capture fifo status... 
^C  ------------------------------
  Interrupted by User
  First interrupt received; Ginkgo will run any cleanup and reporting nodes but will skip all remaining specs.  Interrupt again to skip cleanup.
  Here's a current progress report:
    pipes detects on the write end when a pipe breaks (Spec Runtime: 10m47.887s)
      /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
      In [It] (Node Runtime: 10m47.887s)
        /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
        At [By Step] closing read end of pipe (Step Runtime: 10m45.874s)
          /workspaces/cshargextcap/pipe/checker_notwin_test.go:61

        Spec Goroutine
        goroutine 10 [syscall]
          syscall.syscall(0x49db6c40?, 0x1f40a68?, 0x10?, 0xc000080900?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          golang.org/x/sys/unix.poll(0x8?, 0x1377dc0?, 0xc0002b2001?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/zsyscall_darwin_amd64.go:323
          golang.org/x/sys/unix.Poll({0xc00029e080?, 0x1?, 0x1?}, 0x3e8?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/syscall_bsd.go:595
        > github.com/siemens/cshargextcap/pipe.WaitTillBreak(0xc0000b0000)
            /workspaces/cshargextcap/pipe/checker_notwin.go:34
        > github.com/siemens/cshargextcap/pipe.glob..func1.1()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:74
          github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0x0, 0x0})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/node.go:463
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:889
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 6
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:876

        Goroutines of Interest
        goroutine 33 [syscall]
          syscall.syscall(0xf?, 0xf?, 0x800000?, 0x7ffff800000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          syscall.read(0xc00029c000?, {0xc0000ba000?, 0x0?, 0x0?})
            /usr/local/go/src/syscall/zsyscall_darwin_amd64.go:1209
          syscall.Read(...)
            /usr/local/go/src/syscall/syscall_unix.go:181
          internal/poll.ignoringEINTRIO(...)
            /usr/local/go/src/internal/poll/fd_unix.go:736
          internal/poll.(*FD).Read(0xc00029c000, {0xc0000ba000, 0x8000, 0x8000})
            /usr/local/go/src/internal/poll/fd_unix.go:160
          os.(*File).read(...)
            /usr/local/go/src/os/file_posix.go:29
          os.(*File).Read(0xc00029a000, {0xc0000ba000?, 0xc0000b0008?, 0x1381aa0?})
            /usr/local/go/src/os/file.go:118
          io.copyBuffer({0x14a5c80, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:430
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
          os.genericReadFrom(0x13ea620?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:161
          os.(*File).ReadFrom(0x0?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:155
          io.copyBuffer({0x14a5ce0, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:416
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
        > github.com/siemens/cshargextcap/pipe.glob..func1.1.3()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:54
        > github.com/siemens/cshargextcap/pipe.glob..func1.1 in goroutine 10
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:49
  ------------------------------
• [INTERRUPTED] [647.896 seconds]
pipes [It] detects on the write end when a pipe breaks
/workspaces/cshargextcap/pipe/checker_notwin_test.go:20

  Timeline >>
  STEP: creating a temporary named pipe/fifo and opening its ends @ 12/18/23 09:02:13.156
  STEP: waiting for pipe to break @ 12/18/23 09:02:13.168
  STEP: continously draining the read end of the pipe into /dev/null @ 12/18/23 09:02:13.168
  STEP: writing some data into the pipe @ 12/18/23 09:02:13.168
  STEP: closing read end of pipe @ 12/18/23 09:02:15.169
  [INTERRUPTED] in [It] - /workspaces/cshargextcap/pipe/checker_notwin_test.go:20 @ 12/18/23 09:13:01.039
  Interrupted by User
  First interrupt received; Ginkgo will run any cleanup and reporting nodes but will skip all remaining specs.  Interrupt again to skip cleanup.
  Here's a current progress report:
    pipes detects on the write end when a pipe breaks (Spec Runtime: 10m47.887s)
      /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
      In [It] (Node Runtime: 10m47.887s)
        /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
        At [By Step] closing read end of pipe (Step Runtime: 10m45.874s)
          /workspaces/cshargextcap/pipe/checker_notwin_test.go:61

        Spec Goroutine
        goroutine 10 [syscall]
          syscall.syscall(0x49db6c40?, 0x1f40a68?, 0x10?, 0xc000080900?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          golang.org/x/sys/unix.poll(0x8?, 0x1377dc0?, 0xc0002b2001?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/zsyscall_darwin_amd64.go:323
          golang.org/x/sys/unix.Poll({0xc00029e080?, 0x1?, 0x1?}, 0x3e8?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/syscall_bsd.go:595
        > github.com/siemens/cshargextcap/pipe.WaitTillBreak(0xc0000b0000)
            /workspaces/cshargextcap/pipe/checker_notwin.go:34
        > github.com/siemens/cshargextcap/pipe.glob..func1.1()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:74
          github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0x0, 0x0})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/node.go:463
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:889
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 6
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:876

        Goroutines of Interest
        goroutine 33 [syscall]
          syscall.syscall(0xf?, 0xf?, 0x800000?, 0x7ffff800000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          syscall.read(0xc00029c000?, {0xc0000ba000?, 0x0?, 0x0?})
            /usr/local/go/src/syscall/zsyscall_darwin_amd64.go:1209
          syscall.Read(...)
            /usr/local/go/src/syscall/syscall_unix.go:181
          internal/poll.ignoringEINTRIO(...)
            /usr/local/go/src/internal/poll/fd_unix.go:736
          internal/poll.(*FD).Read(0xc00029c000, {0xc0000ba000, 0x8000, 0x8000})
            /usr/local/go/src/internal/poll/fd_unix.go:160
          os.(*File).read(...)
            /usr/local/go/src/os/file_posix.go:29
          os.(*File).Read(0xc00029a000, {0xc0000ba000?, 0xc0000b0008?, 0x1381aa0?})
            /usr/local/go/src/os/file.go:118
          io.copyBuffer({0x14a5c80, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:430
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
          os.genericReadFrom(0x13ea620?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:161
          os.(*File).ReadFrom(0x0?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:155
          io.copyBuffer({0x14a5ce0, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:416
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
        > github.com/siemens/cshargextcap/pipe.glob..func1.1.3()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:54
        > github.com/siemens/cshargextcap/pipe.glob..func1.1 in goroutine 10
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:49
  << Timeline

  [INTERRUPTED] Interrupted by User
  In [It] at: /workspaces/cshargextcap/pipe/checker_notwin_test.go:20 @ 12/18/23 09:13:01.039

  This is the Progress Report generated when the interrupt was received:
    pipes detects on the write end when a pipe breaks (Spec Runtime: 10m47.887s)
      /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
      In [It] (Node Runtime: 10m47.887s)
        /workspaces/cshargextcap/pipe/checker_notwin_test.go:20
        At [By Step] closing read end of pipe (Step Runtime: 10m45.874s)
          /workspaces/cshargextcap/pipe/checker_notwin_test.go:61

        Spec Goroutine
        goroutine 10 [syscall]
          syscall.syscall(0x49db6c40?, 0x1f40a68?, 0x10?, 0xc000080900?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          golang.org/x/sys/unix.poll(0x8?, 0x1377dc0?, 0xc0002b2001?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/zsyscall_darwin_amd64.go:323
          golang.org/x/sys/unix.Poll({0xc00029e080?, 0x1?, 0x1?}, 0x3e8?)
            /go/pkg/mod/golang.org/x/sys@v0.14.0/unix/syscall_bsd.go:595
        > github.com/siemens/cshargextcap/pipe.WaitTillBreak(0xc0000b0000)
            /workspaces/cshargextcap/pipe/checker_notwin.go:34
        > github.com/siemens/cshargextcap/pipe.glob..func1.1()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:74
          github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0x0, 0x0})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/node.go:463
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:889
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 6
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:876

        Goroutines of Interest
        goroutine 33 [syscall]
          syscall.syscall(0xf?, 0xf?, 0x800000?, 0x7ffff800000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          syscall.read(0xc00029c000?, {0xc0000ba000?, 0x0?, 0x0?})
            /usr/local/go/src/syscall/zsyscall_darwin_amd64.go:1209
          syscall.Read(...)
            /usr/local/go/src/syscall/syscall_unix.go:181
          internal/poll.ignoringEINTRIO(...)
            /usr/local/go/src/internal/poll/fd_unix.go:736
          internal/poll.(*FD).Read(0xc00029c000, {0xc0000ba000, 0x8000, 0x8000})
            /usr/local/go/src/internal/poll/fd_unix.go:160
          os.(*File).read(...)
            /usr/local/go/src/os/file_posix.go:29
          os.(*File).Read(0xc00029a000, {0xc0000ba000?, 0xc0000b0008?, 0x1381aa0?})
            /usr/local/go/src/os/file.go:118
          io.copyBuffer({0x14a5c80, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:430
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
          os.genericReadFrom(0x13ea620?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:161
          os.(*File).ReadFrom(0x0?, {0x14a5d20?, 0xc00029a000?})
            /usr/local/go/src/os/file.go:155
          io.copyBuffer({0x14a5ce0, 0xc0000b0008}, {0x14a5d20, 0xc00029a000}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:416
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
        > github.com/siemens/cshargextcap/pipe.glob..func1.1.3()
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:54
        > github.com/siemens/cshargextcap/pipe.glob..func1.1 in goroutine 10
            /workspaces/cshargextcap/pipe/checker_notwin_test.go:49

        Other Goroutines
        goroutine 6 [running]
          github.com/onsi/ginkgo/v2/internal.extractRunningGoroutines()
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:181
          github.com/onsi/ginkgo/v2/internal.NewProgressReport(_, {{0xc000023d50, 0x1, 0x1}, {0xc0001dc800, 0x1, 0x1}, {0xc000010690, 0x1, 0x1}, ...}, ...)
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:75
          github.com/onsi/ginkgo/v2/internal.(*Suite).generateProgressReport(_, _)
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:381
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode(_, {0x2, 0x4, {0x1409e6b, 0x2b}, 0xc000023cf0, {{0x15172e3, 0x34}, 0x14, {0x0, ...}, ...}, ...}, ...)
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:975
          github.com/onsi/ginkgo/v2/internal.(*group).attemptSpec(0xc0002971c0, 0x1, {{0xc00009c240?, 0x2?, 0x2?}, 0x0?})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/group.go:199
          github.com/onsi/ginkgo/v2/internal.(*group).run(0xc0002971c0, {0xc00006ca20?, 0x0?, 0x0?})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/group.go:349
          github.com/onsi/ginkgo/v2/internal.(*Suite).runSpecs(0xc0001a2a80, {0x13fb40f, 0x11}, {0x1733be0, 0x0, 0x0}, {0xc00002c024, 0x1b}, 0x0, {0xc00009e040, ...})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:489
          github.com/onsi/ginkgo/v2/internal.(*Suite).Run(_, {_, _}, {_, _, _}, {_, _}, _, {0x14ab070, ...}, ...)
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:130
          github.com/onsi/ginkgo/v2.RunSpecs({0x14a5d80, 0xc000155040}, {0x13fb40f, 0x11}, {0x0, 0x0, 0x0})
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/core_dsl.go:300
          github.com/siemens/cshargextcap/pipe.TestContainerSharkExtCap(0x0?)
            /workspaces/cshargextcap/pipe/package_test.go:20
          testing.tRunner(0xc000155040, 0x14343f0)
            /usr/local/go/src/testing/testing.go:1595
          testing.(*T).Run in goroutine 1
            /usr/local/go/src/testing/testing.go:1648

        goroutine 1 [chan receive]
          testing.(*T).Run(0xc000154ea0, {0x13ff530?, 0x1626208cf8eac?}, 0x14343f0)
            /usr/local/go/src/testing/testing.go:1649
          testing.runTests.func1(0x17054e0?)
            /usr/local/go/src/testing/testing.go:2054
          testing.tRunner(0xc000154ea0, 0xc0001afc48)
            /usr/local/go/src/testing/testing.go:1595
          testing.runTests(0xc00007f540?, {0x16de300, 0x1, 0x1}, {0xc0001da340?, 0xc0001afd08?, 0x0?})
            /usr/local/go/src/testing/testing.go:2052
          testing.(*M).Run(0xc00007f540)
            /usr/local/go/src/testing/testing.go:1925
          main.main()
            _testmain.go:47

        goroutine 8 [syscall]
          os/signal.signal_recv()
            /usr/local/go/src/runtime/sigqueue.go:149
          os/signal.loop()
            /usr/local/go/src/os/signal/signal_unix.go:23
          os/signal.Notify.func1.1 in goroutine 6
            /usr/local/go/src/os/signal/signal.go:151

        goroutine 17 [select]
          github.com/onsi/ginkgo/v2/internal/interrupt_handler.(*InterruptHandler).registerForInterrupts.func2(0x0?)
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/interrupt_handler/interrupt_handler.go:131
          github.com/onsi/ginkgo/v2/internal/interrupt_handler.(*InterruptHandler).registerForInterrupts in goroutine 6
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/interrupt_handler/interrupt_handler.go:128

        goroutine 9 [select]
          github.com/onsi/ginkgo/v2/internal.RegisterForProgressSignal.func1()
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:32
          github.com/onsi/ginkgo/v2/internal.RegisterForProgressSignal in goroutine 6
            /go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:30
------------------------------

Summarizing 1 Failure:
  [INTERRUPTED] pipes [It] detects on the write end when a pipe breaks
  /workspaces/cshargextcap/pipe/checker_notwin_test.go:20

Ran 1 of 1 Specs in 647.909 seconds
FAIL! - Interrupted by User -- 0 Passed | 1 Failed | 0 Pending | 0 Skipped
--- FAIL: TestContainerSharkExtCap (647.91s)
FAIL

Just installed Go on the mac and ran go test -v ./pipe -ginkgo.v. It hangs as well.

cshargextcap%$ go test -v ./pipe -ginkgo.v
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading github.com/onsi/ginkgo/v2 v2.13.1
go: downloading github.com/onsi/gomega v1.30.0
go: downloading github.com/thediveo/success v1.0.2
go: downloading golang.org/x/sys v0.14.0
go: downloading github.com/google/go-cmp v0.6.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading golang.org/x/net v0.18.0
go: downloading github.com/go-logr/logr v1.3.0
go: downloading golang.org/x/text v0.14.0
=== RUN   TestContainerSharkExtCap
Running Suite: cshargextcap/pipe - repos/cshargextcap/pipe
============================================================================
Random Seed: 1702912022

Will run 1 of 1 specs
------------------------------
pipes detects on the write end when a pipe breaks
repos/cshargextcap/pipe/checker_notwin_test.go:20
  STEP: creating a temporary named pipe/fifo and opening its ends @ 12/18/23 10:07:02.59
  STEP: waiting for pipe to break @ 12/18/23 10:07:02.602
  STEP: continously draining the read end of the pipe into /dev/null @ 12/18/23 10:07:02.602
time="2023-12-18T10:07:02-05:00" level=debug msg="constantly monitoring packet capture fifo status..."
  STEP: writing some data into the pipe @ 12/18/23 10:07:02.603
  STEP: closing read end of pipe @ 12/18/23 10:07:04.604
^C  [INTERRUPTED] in [It] - repos/cshargextcap/pipe/checker_notwin_test.go:20 @ 12/18/23 10:09:23.17
  ------------------------------
  Interrupted by User
  First interrupt received; Ginkgo will run any cleanup and reporting nodes but will skip all remaining specs.  Interrupt again to skip cleanup.
  Here's a current progress report:
    pipes detects on the write end when a pipe breaks (Spec Runtime: 2m20.579s)
      repos/cshargextcap/pipe/checker_notwin_test.go:20
      In [It] (Node Runtime: 2m20.579s)
        repos/cshargextcap/pipe/checker_notwin_test.go:20
        At [By Step] closing read end of pipe (Step Runtime: 2m18.565s)
          repos/cshargextcap/pipe/checker_notwin_test.go:61

        Spec Goroutine
        goroutine 21 [syscall]
          syscall.syscall(0x102fd4b00?, 0x1031c0f18?, 0x140002c2040?, 0x14000280000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          golang.org/x/sys/unix.poll(0x8?, 0x102d24220?, 0x1?)
            go/pkg/mod/golang.org/x/sys@v0.14.0/unix/zsyscall_darwin_arm64.go:323
          golang.org/x/sys/unix.Poll({0x1400029a0d8?, 0x1?, 0x1?}, 0x3e8?)
            go/pkg/mod/golang.org/x/sys@v0.14.0/unix/syscall_bsd.go:595
        > github.com/siemens/cshargextcap/pipe.WaitTillBreak(0x1400029e000)
            repos/cshargextcap/pipe/checker_notwin.go:34
              | // initialize the fdset each time before calling select() ... well, just
              | // because that's a good idea to do. :(
              > n, err := unix.Poll(fds, 1000 /*ms*/)
              | if err != nil {
              |     if err == unix.EINTR {
        > github.com/siemens/cshargextcap/pipe.glob..func1.1()
            repos/cshargextcap/pipe/checker_notwin_test.go:74
              | By("waiting for pipe to break")
              | start := time.Now()
              > WaitTillBreak(w)
              | Expect(time.Since(start).Milliseconds()).To(
              |     BeNumerically(">", 1900), "pipe wasn't broken yet")
          github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0x0, 0x0})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/node.go:463
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:889
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 35
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:876

        Goroutines of Interest
        goroutine 51 [syscall]
          syscall.syscall(0x14000153cc8?, 0x1029dd6f0?, 0x800000?, 0x7ffff800000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          syscall.read(0x1400009c300?, {0x14000300000?, 0x0?, 0x0?})
            /usr/local/go/src/syscall/zsyscall_darwin_arm64.go:1209
          syscall.Read(...)
            /usr/local/go/src/syscall/syscall_unix.go:181
          internal/poll.ignoringEINTRIO(...)
            /usr/local/go/src/internal/poll/fd_unix.go:736
          internal/poll.(*FD).Read(0x1400009c300, {0x14000300000, 0x8000, 0x8000})
            /usr/local/go/src/internal/poll/fd_unix.go:160
          os.(*File).read(...)
            /usr/local/go/src/os/file_posix.go:29
          os.(*File).Read(0x140000f4020, {0x14000300000?, 0x140000f4028?, 0x0?})
            /usr/local/go/src/os/file.go:118
          io.copyBuffer({0x102da5088, 0x140000f4028}, {0x102da5128, 0x140000f4020}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:430
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
          os.genericReadFrom(0x102d3b0e0?, {0x102da5128?, 0x140000f4020?})
            /usr/local/go/src/os/file.go:161
          os.(*File).ReadFrom(0x0?, {0x102da5128?, 0x140000f4020?})
            /usr/local/go/src/os/file.go:155
          io.copyBuffer({0x102da50e8, 0x140000f4028}, {0x102da5128, 0x140000f4020}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:416
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
        > github.com/siemens/cshargextcap/pipe.glob..func1.1.3()
            repos/cshargextcap/pipe/checker_notwin_test.go:54
              |     null := Successful(os.OpenFile("/dev/null", os.O_WRONLY, 0))
              |     defer null.Close()
              >     io.Copy(null, r)
              |     By("pipe draining done")
              | }()
        > github.com/siemens/cshargextcap/pipe.glob..func1.1 in goroutine 21
            repos/cshargextcap/pipe/checker_notwin_test.go:49
              | defer w.Close()
              | 
              > go func() {
              |     defer GinkgoRecover()
              |     By("continously draining the read end of the pipe into /dev/null")
  ------------------------------
• [INTERRUPTED] [140.612 seconds]
pipes [It] detects on the write end when a pipe breaks
repos/cshargextcap/pipe/checker_notwin_test.go:20

  [INTERRUPTED] Interrupted by User
  In [It] at: repos/cshargextcap/pipe/checker_notwin_test.go:20 @ 12/18/23 10:09:23.17

  This is the Progress Report generated when the interrupt was received:
    pipes detects on the write end when a pipe breaks (Spec Runtime: 2m20.579s)
      repos/cshargextcap/pipe/checker_notwin_test.go:20
      In [It] (Node Runtime: 2m20.579s)
        repos/cshargextcap/pipe/checker_notwin_test.go:20
        At [By Step] closing read end of pipe (Step Runtime: 2m18.565s)
          repos/cshargextcap/pipe/checker_notwin_test.go:61

        Spec Goroutine
        goroutine 21 [syscall]
          syscall.syscall(0x102fd4b00?, 0x1031c0f18?, 0x140002c2040?, 0x14000280000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          golang.org/x/sys/unix.poll(0x8?, 0x102d24220?, 0x1?)
            go/pkg/mod/golang.org/x/sys@v0.14.0/unix/zsyscall_darwin_arm64.go:323
          golang.org/x/sys/unix.Poll({0x1400029a0d8?, 0x1?, 0x1?}, 0x3e8?)
            go/pkg/mod/golang.org/x/sys@v0.14.0/unix/syscall_bsd.go:595
        > github.com/siemens/cshargextcap/pipe.WaitTillBreak(0x1400029e000)
            repos/cshargextcap/pipe/checker_notwin.go:34
              | // initialize the fdset each time before calling select() ... well, just
              | // because that's a good idea to do. :(
              > n, err := unix.Poll(fds, 1000 /*ms*/)
              | if err != nil {
              |     if err == unix.EINTR {
        > github.com/siemens/cshargextcap/pipe.glob..func1.1()
            repos/cshargextcap/pipe/checker_notwin_test.go:74
              | By("waiting for pipe to break")
              | start := time.Now()
              > WaitTillBreak(w)
              | Expect(time.Since(start).Milliseconds()).To(
              |     BeNumerically(">", 1900), "pipe wasn't broken yet")
          github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0x0, 0x0})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/node.go:463
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:889
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 35
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:876

        Goroutines of Interest
        goroutine 51 [syscall]
          syscall.syscall(0x14000153cc8?, 0x1029dd6f0?, 0x800000?, 0x7ffff800000?)
            /usr/local/go/src/runtime/sys_darwin.go:23
          syscall.read(0x1400009c300?, {0x14000300000?, 0x0?, 0x0?})
            /usr/local/go/src/syscall/zsyscall_darwin_arm64.go:1209
          syscall.Read(...)
            /usr/local/go/src/syscall/syscall_unix.go:181
          internal/poll.ignoringEINTRIO(...)
            /usr/local/go/src/internal/poll/fd_unix.go:736
          internal/poll.(*FD).Read(0x1400009c300, {0x14000300000, 0x8000, 0x8000})
            /usr/local/go/src/internal/poll/fd_unix.go:160
          os.(*File).read(...)
            /usr/local/go/src/os/file_posix.go:29
          os.(*File).Read(0x140000f4020, {0x14000300000?, 0x140000f4028?, 0x0?})
            /usr/local/go/src/os/file.go:118
          io.copyBuffer({0x102da5088, 0x140000f4028}, {0x102da5128, 0x140000f4020}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:430
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
          os.genericReadFrom(0x102d3b0e0?, {0x102da5128?, 0x140000f4020?})
            /usr/local/go/src/os/file.go:161
          os.(*File).ReadFrom(0x0?, {0x102da5128?, 0x140000f4020?})
            /usr/local/go/src/os/file.go:155
          io.copyBuffer({0x102da50e8, 0x140000f4028}, {0x102da5128, 0x140000f4020}, {0x0, 0x0, 0x0})
            /usr/local/go/src/io/io.go:416
          io.Copy(...)
            /usr/local/go/src/io/io.go:389
        > github.com/siemens/cshargextcap/pipe.glob..func1.1.3()
            repos/cshargextcap/pipe/checker_notwin_test.go:54
              |     null := Successful(os.OpenFile("/dev/null", os.O_WRONLY, 0))
              |     defer null.Close()
              >     io.Copy(null, r)
              |     By("pipe draining done")
              | }()
        > github.com/siemens/cshargextcap/pipe.glob..func1.1 in goroutine 21
            repos/cshargextcap/pipe/checker_notwin_test.go:49
              | defer w.Close()
              | 
              > go func() {
              |     defer GinkgoRecover()
              |     By("continously draining the read end of the pipe into /dev/null")

        Other Goroutines
        goroutine 35 [running]
          github.com/onsi/ginkgo/v2/internal.extractRunningGoroutines()
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:181
          github.com/onsi/ginkgo/v2/internal.NewProgressReport(_, {{0x14000098060, 0x1, 0x1}, {0x1400009a040, 0x1, 0x1}, {0x140000cc018, 0x1, 0x1}, ...}, ...)
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:75
          github.com/onsi/ginkgo/v2/internal.(*Suite).generateProgressReport(_, _)
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:381
          github.com/onsi/ginkgo/v2/internal.(*Suite).runNode(_, {0x2, 0x4, {0x102c52d2f, 0x2b}, 0x14000111cd0, {{0x102e11789, 0x40}, 0x14, {0x0, ...}, ...}, ...}, ...)
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:975
          github.com/onsi/ginkgo/v2/internal.(*group).attemptSpec(0x140000f1190, 0x1, {{0x14000292240?, 0x1400009a040?, 0x1?}, 0x0?})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/group.go:199
          github.com/onsi/ginkgo/v2/internal.(*group).run(0x140000f1190, {0x140000ce000?, 0x0?, 0x0?})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/group.go:349
          github.com/onsi/ginkgo/v2/internal.(*Suite).runSpecs(0x140001c8a80, {0x102c4425f, 0x11}, {0x103028f80, 0x0, 0x0}, {0x140000220f4, 0x29}, 0x0, {0x14000294040?, ...})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:489
          github.com/onsi/ginkgo/v2/internal.(*Suite).Run(_, {_, _}, {_, _, _}, {_, _}, _, {_, ...}, ...)
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/suite.go:130
          github.com/onsi/ginkgo/v2.RunSpecs({0x102da5188, 0x14000105d40}, {0x102c4425f, 0x11}, {0x0, 0x0, 0x0})
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/core_dsl.go:300
          github.com/siemens/cshargextcap/pipe.TestContainerSharkExtCap(0x0?)
            repos/cshargextcap/pipe/package_test.go:20
          testing.tRunner(0x14000105d40, 0x102da2780)
            /usr/local/go/src/testing/testing.go:1595
          testing.(*T).Run in goroutine 1
            /usr/local/go/src/testing/testing.go:1648

        goroutine 1 [chan receive]
          testing.(*T).Run(0x14000105ba0, {0x102c483c2?, 0x165eb9a468a81?}, 0x102da2780)
            /usr/local/go/src/testing/testing.go:1649
          testing.runTests.func1(0x140001e45a0?)
            /usr/local/go/src/testing/testing.go:2054
          testing.tRunner(0x14000105ba0, 0x140001d7c28)
            /usr/local/go/src/testing/testing.go:1595
          testing.runTests(0x1400011b540?, {0x102fcd550, 0x1, 0x1}, {0x40?, 0x102d70ac0?, 0x102ff3740?})
            /usr/local/go/src/testing/testing.go:2052
          testing.(*M).Run(0x1400011b540)
            /usr/local/go/src/testing/testing.go:1925
          main.main()
            _testmain.go:47

        goroutine 37 [syscall]
          os/signal.signal_recv()
            /usr/local/go/src/runtime/sigqueue.go:149
          os/signal.loop()
            /usr/local/go/src/os/signal/signal_unix.go:23
          os/signal.Notify.func1.1 in goroutine 35
            /usr/local/go/src/os/signal/signal.go:151

        goroutine 50 [select]
          github.com/onsi/ginkgo/v2/internal/interrupt_handler.(*InterruptHandler).registerForInterrupts.func2(0x0?)
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/interrupt_handler/interrupt_handler.go:131
          github.com/onsi/ginkgo/v2/internal/interrupt_handler.(*InterruptHandler).registerForInterrupts in goroutine 35
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/interrupt_handler/interrupt_handler.go:128

        goroutine 20 [select]
          github.com/onsi/ginkgo/v2/internal.RegisterForProgressSignal.func1()
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:32
          github.com/onsi/ginkgo/v2/internal.RegisterForProgressSignal in goroutine 35
            go/pkg/mod/github.com/onsi/ginkgo/v2@v2.13.1/internal/progress_report.go:30
------------------------------

Summarizing 1 Failure:
  [INTERRUPTED] pipes [It] detects on the write end when a pipe breaks
  repos/cshargextcap/pipe/checker_notwin_test.go:20

Ran 1 of 1 Specs in 140.613 seconds
FAIL! - Interrupted by User -- 0 Passed | 1 Failed | 0 Pending | 0 Skipped
--- FAIL: TestContainerSharkExtCap (140.61s)
FAIL
FAIL    github.com/siemens/cshargextcap/pipe    141.139s

@thediveo that's frustrating. I just attempted to run the pipe.test per

Just to clarify, previously you asked if I could run go test -v ./pipe -ginkgo.v, I did so running it in the container. I don't have Go installed on the Mac.

Welcome to the club, you've tested the Linux version 😁 -- if I hadn't forgotten to tell you to prepend GOOS=darwin GOARCH=arm64 go test ... we would have caught this sooner, but these things happen, not least to myself. I've pushed a reworked version using unix.Poll and a correctly time-boxed test, so Ctrl-C isn't needed anymore.

Alas, that now perfectly fits in with our results.

I've played around with unix.Kqueue specifically for the BSDs, including Darwin: while the Apple docs specify that I can monitor the write end for writability and the reader disconnecting for sockets, pipes, and fifos, I can't get the EOF event to show up, whatever I do.

you've tested the Linux version

Yup lol, that dawned on me after I saw the GOOS env var. FWIW I'll add the test output after pulling your latest changes (running on mac host).

Just to clarify, the cshargextcap executable built in the container I mentioned above didn't work or was it just the test that didn't work? FYI, I just built the default_darwin_arm64/cshargextcap with your latest changes and I'm able to capture packets 🤷🏻

PROOF OF LIFE

=== RUN   TestContainerSharkExtCap
Running Suite: cshargextcap/pipe - repos/cshargextcap/pipe
============================================================================
Random Seed: 1702913664

Will run 1 of 1 specs
------------------------------
pipes detects on the write end when a pipe breaks
repos/cshargextcap/pipe/checker_notwin_test.go:31
  STEP: creating a temporary named pipe/fifo and opening its ends @ 12/18/23 10:34:24.716
  STEP: waiting for pipe to break @ 12/18/23 10:34:24.728
time="2023-12-18T10:34:24-05:00" level=debug msg="constantly monitoring packet capture fifo status..."
  STEP: continously draining the read end of the pipe into /dev/null @ 12/18/23 10:34:24.728
  STEP: writing some data into the pipe @ 12/18/23 10:34:24.729
  STEP: closing read end of pipe @ 12/18/23 10:34:26.73
time="2023-12-18T10:34:28-05:00" level=debug msg="context done while monitoring packet capture fifo"
  STEP: pipe draining done @ 12/18/23 10:34:28.785
  [FAILED] in [It] - repos/cshargextcap/pipe/checker_notwin_test.go:88 @ 12/18/23 10:34:28.788
• [FAILED] [4.073 seconds]
pipes [It] detects on the write end when a pipe breaks
repos/cshargextcap/pipe/checker_notwin_test.go:31

  [FAILED] break detection failed
  Expected
      <context.deadlineExceededError>: 
      context deadline exceeded
      {}
  to be nil
  In [It] at: repos/cshargextcap/pipe/checker_notwin_test.go:88 @ 12/18/23 10:34:28.788
------------------------------

Summarizing 1 Failure:
  [FAIL] pipes [It] detects on the write end when a pipe breaks
  repos/cshargextcap/pipe/checker_notwin_test.go:88

Ran 1 of 1 Specs in 4.073 seconds
FAIL! -- 0 Passed | 1 Failed | 0 Pending | 0 Skipped
--- FAIL: TestContainerSharkExtCap (4.07s)
FAIL
FAIL    github.com/siemens/cshargextcap/pipe    4.630s
FAIL

@baileys-am absolutely love your "proof of life" 😁, as well as patiently answering my curiosity! As a last resort, I run a make dist on a Intel MacBook pro and (after finding out that I shouldn't try to use the ARM64 version 🤦🏼‍♂️) it works now as it does for you, even on the old Intel Monterey.

Now that leaves me with the conundrum to find out as to why this build works locally, or in the container, but not in CI. And why the unit test still fails on macos...

whohoo 😀 released fresh binaries for cshargextcap 0.9.10, now for both macos on ARM64 and AMD64; the AMD64 binary works on my ancient MacBook pro.

Thank you all for your valuable input, feedback and time!

The unit test still doesn't work on macos, but at least we're having a working final "product" now.

Excellent! Glad I could help. And indeed the latest release 0.9.10 works. Thank you!

siemens / edgeshark

capture process failure: websocket: close sent #31