RabbitMQ AMQP Message not found in WireShark

[businesso...@gmail.com]

I am trying to capture the messages sent to RabbitMQ using WireShark, but I cannot find it in the log, there is not any AMQP messages (there are TCP and others). I checked that it was enabled under Analyze -> Enabled Protocols. I am using the standard port 5672. Read thru different options but ran out of ideas like. Every other resource I read they point out that it will show up in the Protocol, but in my case is not.

Why I am trying to debug the messages using WireShark? Because from time to time messages that are sent to the queue are lost/rejected (not sure yet) but requested task never gets executed.

Inspecting the Log I get:

=INFO REPORT==== 7-Jul-2017::00:05:25 ===

connection <0.718.0> (127.0.0.1:60548 -> 127.0.0.1:5672): user 'guest' authenticated and granted access to vhost '/'

=WARNING REPORT==== 7-Jul-2017::00:05:25===

closing AMQP connection <0.649.0> (127.0.0.1:60548 -> 127.0.0.1:5672):

client unexpectedly closed TCP connection

reason to try to see the messages with WireShark.

[Michael Klishin]

To see AMQP 0-9-1 frames you need to filter by "amqp" (the exact filter

value demonstrated in https://www.rabbitmq.com/amqp-wireshark.html, by the way).

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.
To post to this group, send email to rabbitmq-users@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ

[businesso...@gmail.com]

Hi Mike,

Yes that is exactly why I am opening this post. There is nothing shown, see attached picture.

On Saturday, July 8, 2017 at 4:21:35 PM UTC-7, Michael Klishin wrote:

To see AMQP 0-9-1 frames you need to filter by "amqp" (the exact filter

value demonstrated in https://www.rabbitmq.com/amqp-wireshark.html, by the way).

On Sun, Jul 9, 2017 at 2:17 AM, <businesso...@gmail.com> wrote:

I am trying to capture the messages sent to RabbitMQ using WireShark, but I cannot find it in the log, there is not any AMQP messages (there are TCP and others). I checked that it was enabled under Analyze -> Enabled Protocols. I am using the standard port 5672. Read thru different options but ran out of ideas like. Every other resource I read they point out that it will show up in the Protocol, but in my case is not.

Why I am trying to debug the messages using WireShark? Because from time to time messages that are sent to the queue are lost/rejected (not sure yet) but requested task never gets executed.

Inspecting the Log I get:

=INFO REPORT==== 7-Jul-2017::00:05:25 ===

connection <0.718.0> (127.0.0.1:60548 -> 127.0.0.1:5672): user 'guest' authenticated and granted access to vhost '/'

=WARNING REPORT==== 7-Jul-2017::00:05:25===

closing AMQP connection <0.649.0> (127.0.0.1:60548 -> 127.0.0.1:5672):

client unexpectedly closed TCP connection

reason to try to see the messages with WireShark.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.
To post to this group, send email to rabbitm...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Michael Klishin]

Are you capturing traffic on the correct interface?

[businesso...@gmail.com]

Yes, I am starting to think that is a configuration issue because on 2/2 computers are doing the same thing. I am adding the RabbitMQ log here:

=INFO REPORT==== 6-Jul-2017::15:07:22 ===

Starting RabbitMQ 3.6.9 on Erlang 19.3

Copyright (C) 2007-2016 Pivotal Software, Inc.

Licensed under the MPL.  See http://www.rabbitmq.com/

=INFO REPORT==== 6-Jul-2017::15:07:22 ===

node           : rabbit@DESKTOP

home dir       : C:\WINDOWS

config file(s) : c:/Users/PC/AppData/Roaming/RabbitMQ/rabbitmq.config

cookie hash    : I2Pwkhx2/RN/hLjM4QoRCA==

log            : C:/Users/PC/AppData/Roaming/RabbitMQ/log/RABBIT~1.LOG

sasl log       : C:/Users/PC/AppData/Roaming/RabbitMQ/log/RABBIT~2.LOG

database dir   : c:/Users/PC/AppData/Roaming/RabbitMQ/db/RABBIT~1

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Memory limit set to 6479MB of 16199MB total.

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Disk free limit set to 50MB

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Limiting to approx 8092 file handles (7280 sockets)

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

FHC read buffering:  OFF

FHC write buffering: ON

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Waiting for Mnesia tables for 30000 ms, 9 retries left

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Waiting for Mnesia tables for 30000 ms, 9 retries left

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Priority queues enabled, real BQ is rabbit_variable_queue

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Starting rabbit_node_monitor

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Management plugin: using rates mode 'basic'

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

msg_store_transient: using rabbit_msg_store_ets_index to provide index

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

msg_store_persistent: using rabbit_msg_store_ets_index to provide index

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

started TCP Listener on [::]:5672

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

started TCP Listener on 0.0.0.0:5672

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Management plugin started. Port: 15672

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Statistics database started.

=INFO REPORT==== 6-Jul-2017::15:07:25 ===

Server startup complete; 6 plugins started.

 * rabbitmq_management

 * rabbitmq_management_agent

 * rabbitmq_web_dispatch

 * cowboy

 * amqp_client

 * cowlib

=INFO REPORT==== 6-Jul-2017::15:09:53 ===

accepting AMQP connection <0.507.0> (127.0.0.1:49873 -> 127.0.0.1:5672)

[Luke Bakken]

Capturing localhost on Windows presents special challenges.

Be sure to read this: https://wiki.wireshark.org/CaptureSetup/Loopback

I have used the "Microsoft Loopback Adapter" in the past and it does work, but requires some work to set up correctly.

Thanks,

Luke

[businesso...@gmail.com]

Luke,

Thanks for pointing that feature out; installed npcap, and now I was able to capture the packets with WireShark.

Now tackling the main problem, of: 

client unexpectedly closed TCP connection