doubleirish/kafka_wireshark.md

## kafka_wireshark.md

      
    Raw
  

              kafka_wireshark.md
            
          
    #Using wireshark to sniff kafka messages
Install the latest WireShark application

 sudo add-apt-repository ppa:wireshark-dev/stable
 sudo apt-get update
 sudo apt-get install wireshark

run wireshark with (without SU privledges you may not see the eth0 device)

sudo wireshark

Enable the kafka protocol  in Wireshark

In the Wireshark application navigate thriough the menu options :-  Edit -> Preferences -> Protocol
Select  the "Kafka" protocol and change the broker port to 9092
On the main screen add the following to the Capture filter text box  (replace the IP with that of your machine running kafka) :
       port 9092 && greater 145 && host  <ip_of_host_running_kafka>

Double click on the eth0 interface.
If you’re running kafka cluster via a docker  you can alternatively doubleclick on the docker() interface
You’ll see nowtraffic from kafka clients  .

The  “greater”  capture filter eliminates low level internal kafka message packets from appearing.
This is useful if you only want to see publisher and subscriber messages.