Re: Websockets monitoring

[Mehul Ved]

Sure, you can use it for testing.

On Mar 5, 2014 5:04 PM, Martin Pala <address@hidden> wrote:
>
> Thanks for the trace.
>
> It seems that your server responds with pong (in packet no. 11), but before 
> that, it sends chat text frame with "who" prompt (in packet no. 9):
>
> No.     Time        Source                Destination           Protocol 
> Length Info
>       4 0.000384    127.0.0.1             127.0.0.1             HTTP     309  
>   GET / HTTP/1.1
>
> No.     Time        Source                Destination           Protocol 
> Length Info
>       6 0.001237    127.0.0.1             127.0.0.1             HTTP     197  
>   HTTP/1.1 101 Switching Protocols
>
> No.     Time        Source                Destination           Protocol 
> Length Info
>       8 0.001303    127.0.0.1             127.0.0.1             WebSocket 70  
>    WebSocket Ping [FIN]
>
> WebSocket
>     1... .... = Fin: True
>     .000 .... = Reserved: 0x00
>     .... 1001 = Opcode: Ping (9)
>     0... .... = Mask: False
>     .000 0000 = Payload length: 0
>
> No.     Time        Source                Destination           Protocol 
> Length Info
>       9 0.002225    127.0.0.1             127.0.0.1             WebSocket 75  
>    WebSocket Text [FIN]
>
>     WebSocket
>     1... .... = Fin: True
>     .000 .... = Reserved: 0x00
>     .... 0001 = Opcode: Text (1)
>     0... .... = Mask: False
>     .000 0101 = Payload length: 5
>     Payload
>         Text: "who"
>
> No.     Time        Source                Destination           Protocol 
> Length Info
>      11 0.003986    127.0.0.1             127.0.0.1             WebSocket 70  
>    WebSocket Pong [FIN]
>
>     WebSocket
>     1... .... = Fin: True
>     .000 .... = Reserved: 0x00
>     .... 1010 = Opcode: Pong (10)
>     0... .... = Mask: False
>     .000 0000 = Payload length: 0
>
>
> At this point Monit expects response to its own request, so the protocol test 
> failed.
>
> The server response is OK, we just need to allow server messages (such as 
> this prompt) not related to our own ping request. The websocket.org's service 
> works differently ... it's not chat service, just echo, so it doesn't send 
> any prompt.
>
> Will fix the test. 
>
> Can i use your websocket servis (from the previous email) to verify the test 
> works with it?
>
> Regards,
> Martin
>
>
>
> On 05 Mar 2014, at 12:13, Mehul Ved <address@hidden> wrote:
>
>> Hi Martin,
>>  It's a custom application developed by us in node.js. I'll speak to my 
>> developer and ensure that our application is made RFC compliant. That would 
>> be a much cleaner solution.
>>
>> I'm attaching the pcap file.
>> ________________________________________
>> From: address@hidden <address@hidden> on behalf of Martin Pala 
>> <address@hidden>
>> Sent: Wednesday, March 05, 2014 3:58 PM
>> To: This is the general mailing list for monit
>> Subject: Re: Websockets monitoring
>>
>> Hi,
>>
>> it seems that your websocket server doesn't support ping/pong (part of 
>> websocket specification: RFC 6455) and instead sent some text frame in 
>> response to ping ... either the text frame contains some error description, 
>> websocket ping request is prohibited or the server is not RFC 6455 compliant.
>>
>> The problem can be in the test configuration ... the version 13, origin 
>> "http://www.websocket.org"; works with the demo echo websocket server operate 
>> by websocket.org. Each websocket application has its own version and 13 may 
>> be invalid in your case. Also the origin is part of websocket security model 
>> and origin "http://www.websocket.org"; is basically settings for 
>> websocket.org's service ... not general value - but if it was not accepted 
>> by the server, it should return 403 error as response to HTTP upgrade 
>> request, which it didn't (101 was received, otherwise there will be 
>> different error in log).
>>
>> The websocket.org demo with "location" works for 
>> ws://dev.deltamktgresearch.com:10301, but their echo test doesn't use ping - 
>> it sends just text frame ... such test is not generic and may fail in other 
>> websocket implementations (connect+ping/pong+close should be generic for 
>> every RFC compliant server).
>>
>> We can simplify the test and rely only on websocket connection (http upgrade 
>> request) + websocket close ... this should work on all websocket servers, 
>> even those which don't support ping/pong.
>>
>> Please can you get a network trace of the test? You can use for example 
>> tcpdump/tshark/wireshark/snoop, tcpdump on the machine where Monit is 
>> running:
>>
>>        tcpdump -s 0 -i any -w websocket.pcap port 10301
>>
>> If there is also regular traffic which you don't want to expose to mailing 
>> list, either filter out only the Monit session packets or send the file 
>> directly to me.
>>
>>
>> Regards,
>> Martin
>>
>>
>>
>>
>> On 05 Mar 2014, at 09:32, Mehul Ved <address@hidden> wrote:
>>
>>> Hi Martin,
>>> I tried using the new version of monit but it fails on `monit validate` for 
>>> websockets
>>>
>>> $ which monit
>>> /usr/local/bin/monit
>>>
>>> $ monit --version
>>> This is Monit version 5.8
>>> Copyright (C) 2001-2014 Tildeslash Ltd. All Rights Reserved.
>>>
>>> The lines I've added:
>>>
>>> if failed host dev.deltamktgresearch.com port 10301 protocol websocket
>>>   host "dev.deltamktgresearch.com"
>>>   request "/"
>>>   origin "http://www.websocket.org";
>>>   version 13
>>>   then alert
>>>
>>> $ monit validate --verbose
>>> 'wsserver' zombie check succeeded [status_flag=0000]
>>> 'wsserver' succeeded connecting to INET[dev.deltamktgresearch.com:10301/] 
>>> via TCP
>>> 'wsserver' failed protocol test [WEBSOCKET] at 
>>> INET[dev.deltamktgresearch.com:10301/] via TCP -- WEBSOCKET: pong error -- 
>>> opcode 0x1
>>>
>>>
>>> Using location ws://dev.deltamktgresearch.com:10301 in location box on 
>>> http://websocket.org works perfectly. It responds with "who" which is 
>>> correct. Is there a way to set send/expect to check for the correct 
>>> response?
>>> ________________________________________
>>> From: address@hidden <address@hidden> on behalf of Martin Pala 
>>> <address@hidden>
>>> Sent: Monday, March 03, 2014 2:29 PM
>>> To: This is the general mailing list for monit
>>> Subject: Re: Websockets monitoring
>>>
>>> Hi,
>>>
>>> we have implemented the websocket protocol test, example usage:
>>>
>>> check host websocket.org with address "echo.websocket.org"
>>>   if failed port 80 protocol websocket
>>>     host "echo.websocket.org"
>>>     request "/"
>>>     origin "http://www.websocket.com";
>>>     version 13
>>>   then alert
>>>
>>> The test connects to websocket, performs ping/pong test and closes the 
>>> connection.
>>>
>>> If you want to test it, you can get the development Monit version here: 
>>> https://bitbucket.org/tildeslash/monit/get/master.tar.gz
>>>
>>> Compilation:
>>>
>>>       tar -xzf master.tar.gz
>>>       cd tildeslash-monit-*
>>>       ./bootstrap && ./configure && make
>>>
>>> The monit binary will be in current directory, you can install it to 
>>> "/usr/local/bin" using "make install"
>>>
>>> Regards,
>>> Martin
>>>
>>>
>>> On 24 Feb 2014, at 07:23, Mehul Ved <address@hidden> wrote:
>>>
>>>> Hi,
>>>> I have a node.js service that works as a websocket server. I am working on 
>>>> monitoring it using monit. I haven't been able to find any information 
>>>> about using websockets with monit either in the group archives or using 
>>>> google search. Has anybody worked on this before?
>>>> Is it possible to monitor websockets in monit currently without adding in 
>>>> a websocket client script in between? I can definitely do that but wanted 
>>>> to check if there's a better way to do it without any additional component.
>>>> --
>>>> To unsubscribe:
>>>> https://lists.nongnu.org/mailman/listinfo/monit-general
>>>
>>>
>>>
>>> --
>>> To unsubscribe:
>>> https://lists.nongnu.org/mailman/listinfo/monit-general
>>>
>>> --
>>> To unsubscribe:
>>> https://lists.nongnu.org/mailman/listinfo/monit-general
>>
>>
>>
>> --
>> To unsubscribe:
>> https://lists.nongnu.org/mailman/listinfo/monit-general
>> <websocket.pcap>--
>> To unsubscribe:
>> https://lists.nongnu.org/mailman/listinfo/monit-general
>
>