Run puppetmaster/puppetclients using Dockers 2/4

In my earlier post, we already have set up puppet master and puppet client in the Guest OS, since its easily portable for deployment of applications I would create an docker image so that it would be easy for us to deploy the same in other machines to test in any environment without any overheads.

you can see the previous post on how to install puppet : http://sunlnx.blogspot.in/2016/11/installconfigure-puppet-serverpuppet.html

You first need to install docker packages 

Ubuntu/Debian : https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-16-04

CentOS/Redhat : https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-centos-7

Downloaded the docker images of Centos 6, which will pull the latest docker image.

root@ubuntu:~# docker pull centos:6

6: Pulling from library/centos

Digest: sha256:f3cc24b376d42d9fd9fa914335dddee46ed7b5a2e2dd1ee6df045ce437199d79

Status: Image is up to date for centos:6

root@ubuntu:~#

You need to fire up two containers from the downloaded docker image, one for the puppetmaster and the other for puppetclient. 

root@ubuntu:~# docker run -it --name puppetmaster --hostname puppetmaster.example.com centos:6 /bin/bash

root@puppetmaster /] 

root@ubuntu:~# docker run -it --name puppetclient --hostname puppetclient.example.com centos:6 /bin/bash

root@puppetmaster /] 

root@ubuntu:~# docker ps

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

7d2c3af9ff52        76aa66802274        "/bin/bash"         24 hours ago        Up 3 hours                              puppetclient

113707c588ab        6f9a4933ce57        "/bin/bash"         2 days ago          Up 3 hours                              puppetmaster

root@ubuntu:~#

Once you have fired up your docker containers, make sure you have your both hosts puppetmaster and puppetclient are resolvable, either in DNS or in /etc/hosts.

you can install/configure puppet master and puppet client as in the article http://sunlnx.blogspot.in/2016/11/installconfigure-puppet-serverpuppet.html 

once they are completed, you can stop both the containers. 

root@ubuntu:~#docker stop puppetmaster

puppetmaster

root@ubuntu:~#docker stop puppetclient

puppetclient

root@ubuntu:~#docker ps

<display no running containers>

root@ubuntu:~#docker commit -m "puppetmaster" <CONTAINER ID> <dockerid>/puppetmaster:<tag>

root@ubuntu:~#docker commit -m "puppetclient" <CONTAINER ID> <dockerid>/puppetclient:<tag>

root@ubuntu:~#docker images

<you could now see your image installed with puppetmaster and puppetclient>

anyone who has no account for docker hub, you can create a new account. https://hub.docker.com/. 

already account exists, then you can push you docker image created puppetmaster/puppetclient to your account and can be download later in any of the platform installed with dockers to fire up two containers. 

root@ubuntu:~#docker login

Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https://hub.docker.com to create one.

Username (dockerid):

.

.

<successful>

root@ubuntu:~#docker push <dockerid>/puppetmaster:latest

root@ubuntu:~#docker push <dockerid>/puppetclient:lastest

you have now successfully uploaded your images to your dockerid repository. 

you can download anytime if you require your docker images using below command and start to firing up your container.

root@ubuntu:~#docker run -it --name puppetmaster --hostname puppetmaster.example.com <dockerid>/puppetmaster /bin/bash

root@puppetmaster /] service puppetmaster start

root@puppetmaster /] echo "172.17.0.3 puppetclient.example.com" >>/etc/hosts

root@ubuntu:~#docker run -it --name puppetclient --hostname puppetclient.example.com <dockerid>/puppetclient /bin/bash

root@puppetclient /]echo "172.17.0.2 puppetmaster.example.com" >>/etc/hosts"

Try to check if they are able to ping resolve both the nodes and once done your puppetmaster/puppetclient with docker images are ready to use.

try executing "testing" part from particle http://sunlnx.blogspot.in/2016/11/installconfigure-puppet-serverpuppet.html to see it all works as expected.

Thanks for re-sharing​

​Install/configure puppet server/puppet client Guest OS - Linux 1/4

1. In this post I only wish to tell how to install and configure puppet master & puppet client on the Guest OS.

2. In my next post, we shall install docker to run puppet master and puppet client .... 

3. we will try to write few manifests also shall configure different environments for running puppet....

Docker Installed OS: Ubuntu 16.04

Tested on: RHEL/CentOS/Ubuntu 

Puppet Version: 3.8.7 

Let me first let you know how to install puppet server/puppet client and what change needs to be modified ?
Make sure your hostnames are resolvable, you could either configure DNS or add the hostnames in you /etc/hosts file.

Hostname & Descriptions of few major tools :

puppetmaster.example.com: (puppet master) 

This would be centralized managemnt daemon, and each manahed node will run puppet agent. It would serve compiled configuration, files, templates,

and custom plugins to managed nodes.

puppetclient.example.com: (puppet agent)   

puppet agent runs on each managed node, which will wake up every 30 mins by default to check with pupper master, send the new information about the system facts, and receive 'compiled catalog' describing the desired system configuration. puppet agent is then reponsible for making the system match the compile catalog. If 'pluginsync' is enabled in node configuration, custom plugins stored on pupper master are transferred automatically. 

puppet master then determines what information a given managed node should see based on unique identifier "certname". 

puppet apply:

runs puppet locally, to test manifests, non-networked case. it will not contact puppet master server, otherwise it just 'puppet agent' 

puppet cert: 

when the client contacts the server it will generate a certificate which should be signed by master to secure connection. 'autosign=true' will sign automatically when the clients connects to master server. 

#puppet cert list --all

if 'autosign' option not enabled, then you might require to sign, 

#puppet cert sign puppetclient.example.com

puppetmaster Install/Configure : 

Download RPM from puppetlabs to install puppet server

[root@puppetmaster ~]#rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm

I had an issue with the time sync between puppetmaster and puppetclients and hence has to install 'ntp' and configure. 

it is not required for the VM, however that has fixed my issues hence thought to mention over here.

[root@puppetmaster ~]#yum install ntp

append any entry in 'server' part of the ntp.conf file

[root@puppetmaster ~]#vim /etc/ntp.conf

server <puppetmasterserver IP>

[root@puppetmaster ~]#service ntpd restart

[root@puppetmaster ~]#yum clean all; yum install puppet-server

Change your config files accordingly to your IP address and the hostnames.

[root@puppetmaster ~]#cat > /etc/puppet/puppet.conf

[main]

    certname = puppetmaster.example.com

    logdir = /var/log/puppet

    vardir = /var/lib/puppet

    rundir = /var/run/puppet

    ssldir = /var/lib/puppet/ssl

    factpath = $vardir/lib/facter

# This section is used by the Puppet master and Puppet cert applications.

[master]

    dns_alt_names = puppetmaster.example.com

    ssl_client_header = SSL_CLIENT_S_DN

    ssl_client_verify_header = SSL_CLIENT_VERIFY

    autosign = true

[root@puppetmaster ~]#

[root@puppetmaster ~]# puppet cert list --all

+ "puppetclient.example.com" (SHA256) EC:72:61:11:EA:C9:65:B4:43:B0:C7:45:56:38:40:A3:B4:85:E3:D9:27:8A:BB:56:BF:62:81:57:1A:91:AE:E0

+ "puppetmaster.example.com" (SHA256) EB:6B:BA:B1:03:8D:3B:CD:76:5D:46:9F:B9:2E:0D:3E:DF:70:8C:DE:35:F3:7D:D7:1A:81:FA:BA:63:31:DC:55 (alt names: "DNS:puppetmaster.example.com")

[root@puppetmaster ~]#

[root@puppetmaster ~]#service puppetmaster start

Ensure you have your master server has port listening

[root@puppetmaster ~]# netstat -tupln | grep 8140

tcp        0      0 0.0.0.0:8140                0.0.0.0:*                   LISTEN      -

[root@puppetmaster ~]#

Testing :

[root@puppetmaster ~]#cd /etc/puppet/manifests

[root@puppetmaster /etc/puppet/manifests]#cat > site.pp

file {'masterserver':

    ensure => present,

    path => '/tmp/masterserver',

    mode => 644,

    owner => root,

    group => root,

    content => 'on succsful test I must be born in /tmp/ and reader should study this message

'

}

[root@puppetmaster /etc/puppet/manifests]#

[root@puppetmaster /etc/puppet/manifests]# puppet apply site.pp

Notice: Compiled catalog for puppetmaster.example.com in environment production in 0.07 seconds

Notice: /Stage[main]/Main/File[masterserver]/ensure: created

Notice: Finished catalog run in 0.02 seconds

[root@puppetmaster /etc/puppet/manifests]# 

[root@puppetmaster ]# ls -l /tmp/masterserver

-rw-r--r-- 1 root root 78 Nov  2 02:27 /tmp/masterserver

[root@puppetmaster ~]#

[root@puppetmaster ~]# cat /tmp/masterserver

on succsful test I must be born in /tmp/ and reader should study this message

[root@puppetmaster ~]#

puppet client Install/Configure :

Download RPM from puppetlabs to install puppet server

[root@puppetclient ~]#rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm

I had an issue with the time sync between puppet master and puppet clients and hence has to install 'ntp' and configure. 

it is not required for the VM, however that has fixed my issues hence thought to mention over here.

[root@puppetclient ~] scp root@puppetmaster.example.com:/etc/ntp.conf /etc/ntp.conf

[root@puppetclient ~] service ntpd restart

[root@puppetclient ~]#yum clean all; yum install puppet

[root@puppetclient ~]# cat /etc/puppet/puppet.conf

[main]

    logdir = /var/log/puppet

    vardir = /var/lib/puppet

    rundir = /var/run/puppet

    ssldir = /var/lib/puppet/ssl

    factpath = $vardir/lib/facter

# This section is used by the Puppet master and Puppet cert applications.

[agent]

    ssl_client_header = SSL_CLIENT_S_DN

    ssl_client_verify_header = SSL_CLIENT_VERIFY

    server = puppetmaster.example.com

[root@puppetclient ~]#

[root@puppetclient ~]# puppet agent -t

Info: Retrieving pluginfacts

Info: Retrieving plugin

Info: Caching catalog for puppetclient.example.com

Info: Applying configuration version '1478054988'

Notice: /Stage[main]/Main/File[masterserver]/ensure: created

Notice: Finished catalog run in 0.02 seconds

[root@puppetclient ~]#

[root@puppetclient ~]# ls -l /tmp/masterserver

-rw-r--r-- 1 root root 78 Nov  2 02:51 /tmp/masterserver

[root@puppetclient ~]#

[root@puppetclient ~]# cat /tmp/masterserver

on succsful test I must be born in /tmp/ and reader should study this message

[root@puppetclient ~]#

Your puppet master and puppet client are ready, enjoy  !

Thanks for re-sharing

Linux Containers Beginners Guide

​

LXC(Linux Containers) is a user-space interface for the Linux kernel container features. Through a powerful API and simple tools, it lets Linux users easily create and manage system or application containers. I tried to consolidate most of the daily usages who ever is working on the lxc in simple form.

Installation:

Centos: yum install lxc lxc-templates
Ubuntu: sudo apt-get install lxc lxc-templates

Additional information: 

LXD is a container "hypervisor" founded and currently led by canonical and ubuntu with contributions from a range of other companies and individual contributors.

Some of the biggest features of LXD are :

1. Secure by design(resource restrictions ..etc )

2. Scalable ( from containers on laptop to many compute nodes..)

3. Live migration

4. Image based ... etc 

LXD uses LXC through liblxc and its go binding to create and manage containers. we could consider that to be an alternative to LXC's tools and distribution to template systems with added features that coming from being controllable over the network.

LXD Reference : https://linuxcontainers.org/lxd/articles/

LXC Command Manual:

lxc-commands	Descriptions	Commands	Descriptions
lxc-checkconfig	check the current kernel for lxc support
lxc-create	creates a container, -t template shortname of an existing lxc-template script called by lxc-create. e.g ls   /usr/share/lxc/templates	lxc-create -t centos -n first	create a "first" container using "centos" template
lxc-start	run an application inside a container	lxc-start -n first	start container "first" in background
lxc-console	Launch a console for the specified container (ctrl-a + q to detach)	lxc-console -n first	enter container in one of the way i.e using console
lxc-attach	run the specified command inside container(bypassing console login) Kernel version >=3.8	lxc-attach -n first lxc-attach -n first -- /etc/init.d/sshd restart	spawn bash directly in the container and restart openssh Running inside the container
lxc-config	query LXC system configuration	lxc-config -l first	lets you know all the valid keys on the container
lxc-info	queries and shows information about containers	lxc-info -n first	Display information of first container, once you have the IP you can SSH to container
lxc-stop	By default, it will request clean shutdown(SIGPWR) of the container to container's init process waiting for 60 sec for exit and then returning. If it fails(SIGKILL) to force shutdown	lxc-stop -n first lxc-stop -n first -k	stop container cleanly from outside incase it fails provide "-k"
lxc-autostart	containers with lxc.start.auto = 1 to start at boot time. To edit each container has /var/lib/lxc/<container>/config edit over there. You can use Lxc-autostart to start/stop/reboot/kill when lxc.start.auto = 1 lxc.group = centos belongs to centos group	lxc-autostart -r -g centos	restart containers belongs to group of centos
lxc-ls	list the containers existing on the system	lxc-ls -f	list all containers per line with its name,state,ipv4,ipv6 address
lxc-freeze	freeze all process inside containers, useful for batch managers to Schdule a group of processes	lxc-freeze -n first	process inside first container frozen, to view state lxc-ls -f
lxc-unfreeze	thaw all process previously frozen containers	lxc-unfreeze -n first	process resumed in first container, view staus lxc-ls -f
lxc-device	manage devices of running containers	lxc-device [add/del] -n first /dev/ttyS0	creates/deletes /dev/ttyS0 in container first based on matching device on the host
lxc-copy	lxc-clone and lxc-start-ephemeral has been depreciated and lxc-copy has Been replaced. Creates and optionally starts copies of existing containers Whole root fs copied to new container	lxc-copy -n first -N clone-first	Create a clone of first container
lxc-snapshot	snapshot existing container, i.e small copy-on-write copies of the original container.	lxc-snapshot -n first -c snap-first lxc-snapshot -n first -L -C Lxc-snapshot -n first -r snap-first lxc-snapshot -n first -r snap0 firstsnap0	capture the snapshot confirm your snapshot created revert container at a later point of time if you wish restore snapshot as its own container
lxc-top	displays container statistics.for performance reasons kernel does not account kernel memory unless kernel memory set
lxc-destroy	destroys the system object previously created by the lxc-create command. Stop container before destroying	lxc-destroy -n first	Destroy first container

LXC Reference : ​

https://en.wikipedia.org/wiki/LXC

https://linuxcontainers.org/

Thanks for re-sharing !

Compile and install new kernel on CentOS

Objective: Compile and install new kernel 

OS: CentOS 6.7

Current kernel version  : 2.6.32

Upgraded kernel version : 3.14.77

Download the latest kernel version from https://www.kernel.org/ to /tmp.

1. Make sure you install "Development Tools" using yum which includes gcc packages which are required for compiling kernel. 

[root@centos ~]# yum groupinstall "Development Tools"

Loaded plugins: fastestmirror, security

Setting up Group Process

Loading mirror speeds from cached hostfile

Package 1:make-3.81-20.el6.x86_64 already installed and latest version

.

<snip>

.

2. Extract the newer kernel to /usr/src directory and create an soft link for 'linux' directory.  That would be the directory which is required for you to compile your newer kernel.

[root@centos ~]# tar -Jxvf linux-4.7.2.tar.xz -C /usr/src/

[root@centos src]# ln -s linux-4.7.2/ linux

[root@centos src]# ls

debug  kernels  linux  linux-4.7.2

[root@centos src]# cd linux

[root@centos linux]# ls

arch   certs    CREDITS  Documentation  firmware  include  ipc     Kconfig  lib          Makefile  net     REPORTING-BUGS  scripts   sound  usr

block  COPYING  crypto   drivers        fs        init     Kbuild  kernel   MAINTAINERS  mm        README  samples         security  tools  virt

[root@centos linux]#

3. Since I have only newer kernel and not much to be cleaned for older unnecessary modules, I would choose 'mid-range' i...e mrproper. You can choose depending on your compilations. for more info type 'make help' 

Cleaning targets:

  clean           - Remove most generated files but keep the config and

                    enough build support to build external modules

  mrproper        - Remove all generated files + config + various backup files

  distclean       - mrproper + remove editor backup and patch files

[root@centos linux]# make mrproper

[root@centos linux]#

4. Despite installing "Development Tools", you additional are required to install 'ncurses-devel' for menuconfig (custom configuration of the new kernel i..e which modules needs to be compiled or loadable by kernel) and after saving you it would create a .config file. 

[root@centos linux]#make menuconfig

The one chosen with * modules will be compiled and others which are unchecked they wouldn't be compiled. Hence un-necessary modules which are not required for your system need not be checked here. so you can only choose what your system wishes to do.

5. Compile your actual kernel, which will take around 15-20 mins depending on your number of CPU.

[root@centos linux]# make bzImage

  HOSTCC  scripts/kconfig/conf.o

  HOSTLD  scripts/kconfig/conf

scripts/kconfig/conf  --silentoldconfig Kconfig

.

.

<snip>

.

.

  BUILD   arch/x86/boot/bzImage

Setup is 15164 bytes (padded to 15360 bytes).

System is 4374 kB

CRC 96b7ee84

Kernel: arch/x86/boot/bzImage is ready  (#1)

[root@centos linux]#

6. compile your modules would considerably takes more time than kernel ( approx 60-90 mins ) depending on your nummber of CPU

root@centos linux]# make modules

make[1]: Nothing to be done for `all'.

make[1]: Nothing to be done for `relocs'.

  CHK     include/config/kernel.release

  CHK     include/generated/uapi/linux/version.h

  CHK     include/generated/utsrelease.h

  CALL    scripts/checksyscalls.sh

 .

 .

 <snip>

 .

 .

  H16TOFW firmware/edgeport/down2.fw

  IHEX    firmware/edgeport/down3.bin

  IHEX2FW firmware/whiteheat_loader.fw

  IHEX2FW firmware/whiteheat.fw

  IHEX2FW firmware/keyspan_pda/keyspan_pda.fw

  IHEX2FW firmware/keyspan_pda/xircom_pgs.fw

[root@centos linux]#

7. copies all the modules to a new directory .. /lib/modules/3.14.77/

[root@centos linux]# make modules_install

  INSTALL arch/x86/crypto/aes-x86_64.ko

  INSTALL arch/x86/crypto/aesni-intel.ko

  INSTALL arch/x86/crypto/crc32c-intel.ko

  INSTALL arch/x86/crypto/crct10dif-pclmul.ko

  .

  .

  <snip>

  .

  .

  INSTALL /lib/firmware/keyspan_pda/keyspan_pda.fw

  INSTALL /lib/firmware/keyspan_pda/xircom_pgs.fw

  DEPMOD  3.14.77

[root@centos linux]#

8. Move kernel to the right location and name it correctly , update initramfs, grub so boot up with new kernel.

[root@centos linux]# make install

sh /usr/src/linux-3.14.77/arch/x86/boot/install.sh 3.14.77 arch/x86/boot/bzImage \

                System.map "/boot"

ERROR: modinfo: could not find module parport

ERROR: modinfo: could not find module snd_page_alloc

[root@centos linux]#

On summary, below are the commands used for building newer kernel.

make mrproper

make menuconfig

make bzImage

make modules

make modules_install

make install

9 Reboot system and boot into new kernel from the grub menu.

[root@centos linux]# reboot

[root@centos ~]# uptime

 10:39:41 up 0 min,  2 users,  load average: 0.00, 0.00, 0.00

[root@centos ~]#

[root@centos ~]# uname -r

3.14.77

[root@centos ~]#

Thanks for re-sharing. 

Troubleshoot network problem using tshark

How tshark works ?

When a packet arrives at the network card, the MAC destination address is checked to see if it matches yours, in which case an interrupt service routine will be generated and handled by the network driver. 

Subsequently, the received data is copied to a memory block defined in the kernel and from there it will be processed by the corresponding protocol stack to be delivered to the appropriate application in user space. Parallel to this process, when Tshark is capturing traffic, the network driver sends a copy of the packets to a kernel subsystem called Packet Filter, which will filter and store in a buffer the desired packets. These packets will be received by Dumpcap (in user space) whose main goal will be to write them into a libpcap file format to be subsequently read by Tshark. As new packets arrive, Dumpcap will add them to the same capture file and it will notify Tshark about their arrival so that they can be processed.

My objective would be to give you brief tutorial on how to find problems related to performance of network, could be due to bandwidth etc.. so we could use tshark to try and find out which hosts are generating more traffic and what type of data are they sending..

List all the network interfaces - tshark -D

Capture traffic from network interface and write to file -

#tshark -i <interface> -w traffic.pacap

How to capture and analyze traffic using tshark ? 

1. Determine which IPs in your VLAN(IPADDRES/NETMASK) could be misusing the network would be able to get IP list. list by dfault would be sorted according to total number of frames, so it could give an idea of heavy talkers.

#tshark -r traffic.pcap -q -z "conv,ip,ip.addr==74.125.130.0/24"

================================================================================

IPv4 Conversations

Filter:ip.addr==74.125.130.0/24

                                               |       <-      | |       ->      | |     Total     |   Rel. Start   |   Duration   |

                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |                |              |

74.125.130.102       <-> 10.0.2.15                105     27191     129     21393     234     48584   112.306444555       260.0255

74.125.130.95        <-> 10.0.2.15                 34      3395      36     11639      70     15034   263.618378290       108.6899

74.125.130.93        <-> 10.0.2.15                 32      3601      37     11601      69     15202   109.882120656       177.0934

================================================================================

2. With above inforamtion we know that IP 74.125.130.102 represents one of the host which is generating more traffic to communicate with other machines on the network 74.125.130.0/24. 

You could create another pcap file just with the traffic generated by that machine(74.125.130.102)

#tshark -r traffic.pcap -R "ip.addr==74.125.130.102" -w ip.pcap

# capinfos ip.pcap | grep "Number\|time:"

Number of packets:   234

Start time:          Fri Jul 29 20:37:12 2016

End time:            Fri Jul 29 20:41:32 2016

3. Check that your host is not breaking any of your policies of your network, only HTTP & HTTPS is allowed. Below commands will tells us outbound connections to ports other than any (HTTP or HTTPS)

#tshark -o column.format:'" Source ","%s","Destination","%d", "dstport", "%uD","Protocol", "%p"' -r ip.pcap -R "ip.src == 74.125.130.102 && ! dns && tcp.dstport != 80 && tcp.dstport != 443"  | sort -u

74.125.130.102 -> 10.0.2.15    43536 TCP

74.125.130.102 -> 10.0.2.15    43536 TLSv1.2

74.125.130.102 -> 10.0.2.15    43540 TCP

74.125.130.102 -> 10.0.2.15    43540 TLSv1.2

4. I don't have any traffic violating my policies, anyway lets suppose we say if that do exists, then we would have those machines IP address and the port on which they are connected. so to make sure that the traffic is not from other service using the FTP port, lauch tcp stream of that session.

#tshark -o column.format:'"Source","%s","srcport", "%uS","Destination","%d", "dstport", "%uD","Protocol", "%p"' -r ip.pcap -R "tcp.dstport == 43536" | head -1

74.125.130.102 443 10.0.2.15    43536 TCP

#tshark -r ip.pcap -q -z  "follow,tcp,ascii,74.125.130.102:443,10.0.2.15:43536,1"

===================================================================

Follow: tcp,ascii

Filter: ((ip.src eq 74.125.130.102 and tcp.srcport eq 443) and (ip.dst eq 10.0.2.15 and tcp.dstport eq 43536)) or ((ip.src eq 10.0.2.15 and tcp.srcport eq 43536) and (ip.dst eq 74.125.130.102 and tcp.dstport eq 443))

Node 0: 10.0.2.15:43536

Node 1: 74.125.130.102:443

195

............sZ..@G"......!s.....?W...$..5......+./.....

.......3.9./.5.

s.youtube.com..........

...............................h2.spdy/3.1.http/1.1..........

===================================================================

5. Now you could observe that it was "youtube.com" was actullay consuming more bandwidth responsible for slowdown in network.

If you do come across any FTP sessions, troubleshoot the above way, also additionally you will check all the files downloaded by the client.

#tshark -r ip.pcap -q -z  "follow,tcp,ascii,74.125.130.102:443,<Destination machine>:21,1" | grep RETR

6. tshark also allows us to break down each of the protocols captured. Thus we can see hierarchically the number of frames and bytes associated with each protocol. Using capture file, let's see for example the distribution of HTTP and HTTPS traffic used by the IP 74.125.130.102:

#tshark -r traffic.pcap -q -z io,phs,"ip.addr==74.125.130.102 && ssl || http"

===================================================================

Protocol Hierarchy Statistics

Filter: ip.addr==74.125.130.102 && ssl || http

eth                                      frames:122 bytes:40644

  ip                                     frames:122 bytes:40644

    tcp                                  frames:122 bytes:40644

      ssl                                frames:122 bytes:40644

        tcp.segments                     frames:2 bytes:2589

          ssl                            frames:2 bytes:2589

===================================================================

7. It would practically tells us that SSL represents all traffic, let's see the IP's associated with that communication.

#tshark -o column.format:'"destination","%d"' -r  traffic.pcap -R "ip.src ==74.125.130.102 && ssl"| sort -u

10.0.2.15

#whois 10.0.2.15 | grep -i "netname\|netrange"

NetRange:       10.0.0.0 - 10.255.255.255

NetName:        PRIVATE-ADDRESS-ABLK-RFC1918-IANA-RESERVED

With whatever application or information your would get for the IP address/ports, you can create ACLs or IPtables rules to deny certain types of traffic, do a shutdown of a specific port, limit the bandwidth of some protocols so on ...

More references : 

https://www.wireshark.org/docs/wsug_html_chunked/AppToolstshark.html

https://www.youtube.com/watch?v=F2HAPAUqitc

Thanks for re-sharing !