How to safely use Wireshark in Qubes?

[turb...@gmail.com]

Sys-net app or make standalone fedora minimal template?

Subj.

[Unman]

On Tue, Feb 14, 2017 at 09:39:41AM -0800, turb...@gmail.com wrote:
> Sys-net app or make standalone fedora minimal template?
>
> Subj.
>

As you like - I use tcpdump to capture and run wireshark on the captured
stream in a network isolated qube, which seems a reasonable approach.

[raah...@gmail.com]

isn't tcpdump just as vulnerable though if not more?

I run things like that in sys-net since i consider it extremely untrusted, but if you have the resources or want only specific streams, sure a separate template or seperate vm i would assume is more secure.

[Chris Laprise]

On 02/14/2017 09:41 PM, raah...@gmail.com wrote:
>
> isn't tcpdump just as vulnerable though if not more?
>
> I run things like that in sys-net since i consider it extremely untrusted, but if you have the resources or want only specific streams, sure a separate template or seperate vm i would assume is more secure.

Since sys-net is untrusted, try using a proxyVM which should be much
safer. At least it'll work for IP traffic.

Chris