Trond Norbye's Weblog

Use Wireshark to look at your Memcached traffic!

A couple of days ago I got an IM from Stig Bjørlykke (a co-worker from when I worked at Thales Norway) asking about the traffic sent on port 11211. He was looking over the port numbers assigned by IANA and spotted my name there (I applied for port 11211 for memcached traffic some time ago :-).

I pointed Stig to the wiki, and I promised him that I should send him a little test program so that he could look at the traffic.. It took me some days before I sent the email, and a couple of days ago I got a new IM from Stig: "Hey, do you want to test the memcached dissector?".

Unfortunately for me their build farm doesn't build OpenSolaris packages, so I had to test it on my Mac book. I don't use the mac for development, and instead of spending time creating a setup there, I just ran my test program on my OpenSolaris boxes and captured the network traffic with snooop:

trond@opensolaris> pfexec snoop -o /tmp/snoop -d iprb0

I must admit that I was excited when I started Wireshark and loaded the capture file, and I think the result looks great:

If you like to try it yourself, you should download the latest build from http://www.wireshark.org/download/automated/ (or check out the source and build it yourself).

Posted at 12:31PM Mar 04, 2009 by trond in Memcached  |  Comments[0]