1NFSTEST_PKT(1) nfstest_pkt 1.3 NFSTEST_PKT(1)
2
6 nfstest_pkt - Packet trace decoder
7
9 nfstest_pkt [options] <trace1.cap> [<trace2.cap> ...]
10
12 Decode and display all packets in the packet trace file(s) given. The
13 match option gives the ability to search for specific packets within
14 the packet trace file. Other options allow displaying of their corre‐
15 sponding call or reply when only one or the other is matched. Only a
16 range of packets can be displayed if the start and/or end options are
17 used.
18 There are three levels of verbosity in which they are specified using a
20 bitmap, where the most significant bit gives a more verbose output.
21 Verbose level 1 is used as a default where each packet is displayed
22 condensed to one line using the last layer of the packet as the main
23 output. By default only the NFS packets (NFS, MOUNT, NLM, etc.) are
24 displayed.
25 The packet trace files are processed either serially or in parallel.
27 The packets are displayed using their timestamps so they are always
28 displayed in the correct order even if the files given are out of
29 order. If the packet traces were captured one after the other the
30 packets are displayed serially, first the packets of the first file
31 according to their timestamps, then the second and so forth. If the
32 packet traces were captured at the same time on multiple clients the
33 packets are displayed in parallel, packets are interleaved from all the
34 files when displayed again according to their timestamps.
35 Note: When using the --call option, a packet call can be displayed out
37 of order if the call is not matched explicitly but its reply is matched
38 so its corresponding call is displayed right before the reply.
39
43 --version
44 show program's version number and exit
45 -h, --help
47 show this help message and exit
48 -v VERBOSE, --verbose=VERBOSE
50 Verbose level bitmask [default: 1]. bitmap 0x01: one line per
51 packet. bitmap 0x02: one line per layer. bitmap 0x04: real
52 verbose.
53 -l LAYERS, --layers=LAYERS
55 Layers to display [default: 'nfs,nlm,mount,portmap']. Valid
56 layers: ethernet, ip, tcp, udp, rpc, nfs, nlm, mount, portmap
57 -s START, --start=START
59 Start index [default: 0]
60 -e END, --end=END
62 End index [default: 0]
63 -m MATCH, --match=MATCH
65 Match string [default: True]
66 -c, --call
68 If matching a reply packet, include its corresponding call in
69 the output
70 -r, --reply
72 If matching a call packet, include its corresponding reply in
73 the output
74 -d DISPLAY, --display=DISPLAY
76 Print specific packet or part of a packet [default: pkt]
77 -z TZ, --tz=TZ
79 Time zone to use to display timestamps
80 --progress=PROGRESS
82 Display progress bar [default: 1]
83 RPC display:
86 --rpc-type=RPC_TYPE
87 Display RPC type [default: True]
88 --rpc-load=RPC_LOAD
90 Display RPC load type (NFS, NLM, etc.) [default: True]
91 --rpc-ver=RPC_VER
93 Display RPC load version [default: True]
94 --rpc-xid=RPC_XID
96 Display RPC xid [default: True]
97 Packet display:
100 --nfs-mainop=NFS_MAINOP
101 Display NFSv4 main operation only [default: False]
102 --load-body=LOAD_BODY
104 Display RPC payload body [default: True]
105 --frame=FRAME
107 Display record frame number [default: 0]
108 --index=INDEX
110 Display packet number [default: 1]
111 --crc16=CRC16
113 Display CRC16 encoded strings [default: True]
114 --crc32=CRC32
116 Display CRC32 encoded strings [default: True]
117 --strsize=STRSIZE
119 Truncate all strings to this size [default: 0]
120 Debug:
123 --enum-check=ENUM_CHECK
124 If set to True, enums are strictly enforced [default: False]
125 --debug-level=DEBUG_LEVEL
127 Set debug level messages
128
130 # Display all NFS packets (one line per packet)
131 # Display only the NFS packets by default.
132 # Default for --verbose option is 1 -- one line per packet
133 $ nfstest_pkt /tmp/trace.cap
134 # Display all NFS packets (one line per layer)
136 $ nfstest_pkt -v 2 /tmp/trace.cap
137 # Display all NFS packets (real verbose, all items in each layer are
139 displayed)
140 $ nfstest_pkt -v 4 /tmp/trace.cap
141 # Display all NFS packets (display both verbose level 1 and 2)
143 $ nfstest_pkt -v 3 /tmp/trace.cap
144 # Display all TCP packets (this will display all RPC and NFS packets as
146 well)
147 $ nfstest_pkt -l tcp /tmp/trace.cap
148 # Display all packets
150 $ nfstest_pkt -l all /tmp/trace.cap
151 # Display all NFS, NLM, MOUNT and PORTMAP packets
153 $ nfstest_pkt -l nfs,nlm,mount,portmap /tmp/trace.cap
154 # Display packets 100 through 199
156 $ nfstest_pkt -s 100 -e 200 -l all /tmp/trace.cap
157 # Display all NFS packets with non-zero status
159 $ nfstest_pkt -m "nfs.status != 0" /tmp/trace.cap
160 # Display all NFSv4 WRITE packets
162 $ nfstest_pkt -m "rpc.version == 4 and nfs.op == 38" /tmp/trace.cap
163 # Display all NFSv4 WRITE calls
165 $ nfstest_pkt -m "rpc.version == 4 and nfs.argop == 38" /tmp/trace.cap
166 # Display all NFS packets having a file name as f00000001 (OPEN,
168 LOOKUP, etc.)
169 # including their replies
170 $ nfstest_pkt -r -m "nfs.name == 'f00000001'" /tmp/trace.cap
171 # Display all NFS packets with non-zero status including their respec‐
173 tive calls
174 $ nfstest_pkt -c -m "nfs.status != 0" /tmp/trace.cap
175 $ nfstest_pkt -d "pkt_call,pkt" -m "nfs.status != 0" /tmp/trace.cap
176 # Display all TCP packets (just the TCP layer)
178 $ nfstest_pkt -d "pkt.tcp" -l tcp /tmp/trace.cap
179 # Display all NFS file handles
181 $ nfstest_pkt -d "pkt.NFSop.fh" -m "len(nfs.fh) > 0" /tmp/trace.cap
182 # Display all RPC packets including the record information (packet num‐
184 ber, timestamp, etc.)
185 # For verbose level 1 (default) the "," separator will be converted to
186 a
187 # space if all items are only pkt(.*)? or pkt_call(.*)?
188 $ nfstest_pkt -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap
189 # Display all RPC packets including the record information (packet num‐
191 ber, timestamp, etc.)
192 # For verbose level 2 the "," separator will be converted to a new line
193 if
194 # all items are only pkt(.*)? or pkt_call(.*)?
195 $ nfstest_pkt -v 2 -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap
196 # Display all RPC packets including the record information (packet num‐
198 ber, timestamp, etc.)
199 # using the given display format
200 $ nfstest_pkt -d ">>> record: pkt.record >>> rpc: pkt.rpc" -l rpc
201 /tmp/trace.cap
202 # Display all packets truncating all strings to 100 bytes
204 # This is useful when some packets are very large and there
205 # is no need to display all the data
206 $ nfstest_pkt --strsize 100 -v 2 -l all /tmp/trace.cap
207 # Display all NFSv4 packets displaying the main operation of the com‐
209 pound
210 # e.g., display "WRITE" instead of "SEQUENCE;PUTFH;WRITE"
211 $ nfstest_pkt --nfs-mainop 1 -l nfs /tmp/trace.cap
212 # Have all CRC16 strings displayed as plain strings
214 # e.g., display unformatted state ids
215 $ nfstest_pkt --crc16 0 /tmp/trace.cap
216 # Have all CRC32 strings displayed as plain strings
218 # e.g., display unformatted file handles
219 $ nfstest_pkt --crc32 0 /tmp/trace.cap
220 # Display packets using India time zone
222 $ nfstest_pkt --tz "UTC-5:30" /tmp/trace.cap
223 $ nfstest_pkt --tz "Asia/Kolkata" /tmp/trace.cap
224 # Display all packets for all trace files given
226 # The packets are displayed in order using their timestamps
227 $ nfstest_pkt trace1.cap trace2.cap trace3.cap
228
230 formatstr(3), nfstest_alloc(1), nfstest_cache(1), nfstest_delega‐
231 tion(1), nfstest_dio(1), nfstest_file(1), nfstest_interop(1),
232 nfstest_io(1), nfstest_lock(1), nfstest_pnfs(1), nfstest_posix(1),
233 nfstest_sparse(1), nfstest_ssc(1), nfstest_xid(1), packet.pktt(3),
234 packet.record(3), packet.utils(3)
235
238 No known bugs.
239
241 Jorge Mora (mora@netapp.com)
242NFStest 2.1.5 14 February 2017 NFSTEST_PKT(1)