How to open PCAP files in Ostinato on EVE-NG and GNS3

2 minute read

This post is written for EVE-NG. But the procedure is exactly same for GNS3 as well.

Ostinato (standard) for EVE-NG runs the Ostinato GUI controller and Drone agent within a VM accessed via VNC. This makes it very easy to use for almost all workflows.

However, it introduces an extra step for the following Ostinato workflows -

  • Open PCAP files for edit/replay
  • Save Ostinato streams
  • Save Ostinato session

The above workflows access the Ostinato VM’s local filesystem. So you need to transfer files between the host and the VM.

Here are the detailed steps for transferring files.

One time setup

  • Stop the Ostinato instance, if it is running
  • Connect eth0/mgmt interface of Ostinato to Management/Cloud0 network
  • Start the Ostinato instance
  • Open a terminal within the Ostinato VNC instance and run ifconfig eth0 to make sure it gets an IP address via DHCP

Ostinato mgmt ethernet

Transfer files

Ideally, after the one time setup above is done you should be able to ssh/scp into the VM using this IP address. But the default user tc on the Ostinato VM does not have a password and ssh/scp don’t play nice with blank passwords. Therefore -

  • Assign a password to user tc by using the passwd command inside the terminal in the VNC.

Now you can ssh/scp to the DHCP assigned eth0 IP address using the username tc and the password that you assigned

To transfer from host to VM, run on the host -

scp <file> tc@<ostinato-eth0-ip>:~

You can use the above steps to scp the pcap file to the Ostinato appliance and open it from the Ostinato GUI.

To transfer from VM to host, run on the host -

scp tc@<ostinato-eth0-ip>:<full-path-to-file> <destination-path-on-host>

You can use this to save the streams/session from the Ostinato GUI and scp it to the host filesystem.


Note that the Ostinato VM is designed to run out of ramfs, so any changes you make inside the VM (such as setting a password or creating files) won’t survive an appliance reboot.

There is however one exception.

Any files in /home/tc/ can be made persistent by doing a clean shutdown of the appliance from inside the VM -

  1. Select Exit from the menu at the bottom of the window
    Ostinato VM clean shutdown

  2. Select Backup in the Backup options in the TC Exit Options window and click OK
    Ostinato VM backup files

If you do a clean exit as shown above, files in /home/tc will be saved and restored across a reboot. Stopping the Ostinato node from the EVE-NG lab is not a clean exit and therefore your files won’t be pesistent.

For more Ostinato related content, subscribe for email updates.

Leave a Comment