1NFSTEST_PKT(1) nfstest_pkt 1.4 NFSTEST_PKT(1)
2
6 nfstest_pkt - Packet trace decoder
7
9 nfstest_pkt [options] <trace1.cap> [<trace2.cap> ...]
10
12 Decode and display all packets in the packet trace file(s) given. The
13 match option gives the ability to search for specific packets within
14 the packet trace file. Other options allow displaying of their corre‐
15 sponding call or reply when only one or the other is matched. Only a
16 range of packets can be displayed if the start and/or end options are
17 used.
18 There are three levels of verbosity in which they are specified using a
20 bitmap, where the most significant bit gives a more verbose output.
21 Verbose level 1 is used as a default where each packet is displayed
22 condensed to one line using the last layer of the packet as the main
23 output. By default only the NFS packets (NFS, MOUNT, NLM, etc.) are
24 displayed.
25 The packet trace files are processed either serially or in parallel.
27 The packets are displayed using their timestamps so they are always
28 displayed in the correct order even if the files given are out of or‐
29 der. If the packet traces were captured one after the other the pack‐
30 ets are displayed serially, first the packets of the first file accord‐
31 ing to their timestamps, then the second and so forth. If the packet
32 traces were captured at the same time on multiple clients the packets
33 are displayed in parallel, packets are interleaved from all the files
34 when displayed again according to their timestamps.
35 Note: When using the --call option, a packet call can be displayed out
37 of order if the call is not matched explicitly but its reply is matched
38 so its corresponding call is displayed right before the reply.
39
43 --version
44 show program's version number and exit
45 -h, --help
47 show this help message and exit
48 -v VERBOSE, --verbose=VERBOSE
50 Verbose level bitmask [default: 1]. bitmap 0x01: one line per
51 packet. bitmap 0x02: one line per layer. bitmap 0x04: real
52 verbose.
53 -l LAYERS, --layers=LAYERS
55 Layers to display [default: 'rpc']. Valid layers: ethernet, ip,
56 tcp, udp, rpc, nfs, nlm, mount, portmap
57 -s START, --start=START
59 Start index [default: 0]
60 -e END, --end=END
62 End index [default: 0]
63 -m MATCH, --match=MATCH
65 Match string [default: True]
66 -c, --call
68 If matching a reply packet, include its corresponding call in
69 the output
70 -r, --reply
72 If matching a call packet, include its corresponding reply in
73 the output
74 -d DISPLAY, --display=DISPLAY
76 Print specific packet or part of a packet [default: pkt]
77 -z TZ, --tz=TZ
79 Time zone to use to display timestamps
80 --serial
82 Process packet traces one after the other in the order in which
83 they are given. The default is to open all files first and then
84 display the packets ordered according to their timestamps.
85 --progress=PROGRESS
87 Display progress bar [default: 1]
88 RPC display:
91 --rpc-type=RPC_TYPE
92 Display RPC type [default: True]
93 --rpc-load=RPC_LOAD
95 Display RPC load type (NFS, NLM, etc.) [default: True]
96 --rpc-ver=RPC_VER
98 Display RPC load version [default: True]
99 --rpc-xid=RPC_XID
101 Display RPC xid [default: True]
102 Packet display:
105 --nfs-mainop=NFS_MAINOP
106 Display NFSv4 main operation only [default: False]
107 --load-body=LOAD_BODY
109 Display RPC payload body [default: True]
110 --frame=FRAME
112 Display record frame number [default: 0]
113 --index=INDEX
115 Display packet number [default: 1]
116 --crc16=CRC16
118 Display CRC16 encoded strings [default: True]
119 --crc32=CRC32
121 Display CRC32 encoded strings [default: True]
122 --strsize=STRSIZE
124 Truncate all strings to this size [default: 0]
125 Debug:
128 --enum-check=ENUM_CHECK
129 If set to True, enums are strictly enforced [default: False]
130 --enum-repr=ENUM_REPR
132 If set to True, enums are displayed as numbers [default: False]
133 --no-rpc-replies
135 Do not dissect RPC replies
136 --debug-level=DEBUG_LEVEL
138 Set debug level messages
139
141 # Display all NFS packets (one line per packet)
142 # Display only the NFS packets by default.
143 # Default for --verbose option is 1 -- one line per packet
144 $ nfstest_pkt /tmp/trace.cap
145 # Display all NFS packets (one line per layer)
147 $ nfstest_pkt -v 2 /tmp/trace.cap
148 # Display all NFS packets (real verbose, all items in each layer are
150 displayed)
151 $ nfstest_pkt -v 4 /tmp/trace.cap
152 # Display all NFS packets (display both verbose level 1 and 2)
154 $ nfstest_pkt -v 3 /tmp/trace.cap
155 # Display all TCP packets (this will display all RPC and NFS packets as
157 well)
158 $ nfstest_pkt -l tcp /tmp/trace.cap
159 # Display all packets
161 $ nfstest_pkt -l all /tmp/trace.cap
162 # Display all NFS, NLM, MOUNT and PORTMAP packets
164 $ nfstest_pkt -l nfs,nlm,mount,portmap /tmp/trace.cap
165 # Display packets 100 through 199
167 $ nfstest_pkt -s 100 -e 200 -l all /tmp/trace.cap
168 # Display all NFS packets with non-zero status
170 $ nfstest_pkt -m "nfs.status != 0" /tmp/trace.cap
171 # Display all NFSv4 WRITE packets
173 $ nfstest_pkt -m "rpc.version == 4 and nfs.op == 38" /tmp/trace.cap
174 # Display all NFSv4 WRITE calls
176 $ nfstest_pkt -m "rpc.version == 4 and nfs.argop == 38" /tmp/trace.cap
177 # Display all NFS packets having a file name as f00000001 (OPEN,
179 LOOKUP, etc.)
180 # including their replies
181 $ nfstest_pkt -r -m "nfs.name == 'f00000001'" /tmp/trace.cap
182 # Display all NFS packets with non-zero status including their respec‐
184 tive calls
185 $ nfstest_pkt -c -m "nfs.status != 0" /tmp/trace.cap
186 $ nfstest_pkt -d "pkt_call,pkt" -m "nfs.status != 0" /tmp/trace.cap
187 # Display all TCP packets (just the TCP layer)
189 $ nfstest_pkt -d "pkt.tcp" -l tcp /tmp/trace.cap
190 # Display all NFS file handles
192 $ nfstest_pkt -d "pkt.NFSop.fh" -m "len(nfs.fh) > 0" /tmp/trace.cap
193 # Display all RPC packets including the record information (packet num‐
195 ber, timestamp, etc.)
196 # For verbose level 1 (default) the "," separator will be converted to
197 a
198 # space if all items are only pkt(.*)? or pkt_call(.*)?
199 $ nfstest_pkt -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap
200 # Display all RPC packets including the record information (packet num‐
202 ber, timestamp, etc.)
203 # For verbose level 2 the "," separator will be converted to a new line
204 if
205 # all items are only pkt(.*)? or pkt_call(.*)?
206 $ nfstest_pkt -v 2 -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap
207 # Display all RPC packets including the record information (packet num‐
209 ber, timestamp, etc.)
210 # using the given display format
211 $ nfstest_pkt -d ">>> record: pkt.record >>> rpc: pkt.rpc" -l rpc
212 /tmp/trace.cap
213 # Display all packets truncating all strings to 100 bytes
215 # This is useful when some packets are very large and there
216 # is no need to display all the data
217 $ nfstest_pkt --strsize 100 -v 2 -l all /tmp/trace.cap
218 # Display all NFSv4 packets displaying the main operation of the com‐
220 pound
221 # e.g., display "WRITE" instead of "SEQUENCE;PUTFH;WRITE"
222 $ nfstest_pkt --nfs-mainop 1 -l nfs /tmp/trace.cap
223 # Have all CRC16 strings displayed as plain strings
225 $ nfstest_pkt --crc16 0 /tmp/trace.cap
226 # Have all CRC32 strings displayed as plain strings
228 # e.g., display unformatted file handles or state ids
229 $ nfstest_pkt --crc32 0 /tmp/trace.cap
230 # Display packets using India time zone
232 $ nfstest_pkt --tz "UTC-5:30" /tmp/trace.cap
233 $ nfstest_pkt --tz "Asia/Kolkata" /tmp/trace.cap
234 # Display all packets for all trace files given
236 # The packets are displayed in order using their timestamps
237 $ nfstest_pkt trace1.cap trace2.cap trace3.cap
238
240 formatstr(3), nfstest_alloc(1), nfstest_cache(1), nfstest_delega‐
241 tion(1), nfstest_dio(1), nfstest_fcmp(1), nfstest_file(1), nfstest_in‐
242 terop(1), nfstest_io(1), nfstest_lock(1), nfstest_pnfs(1), nf‐
243 stest_posix(1), nfstest_rdma(1), nfstest_sparse(1), nfstest_ssc(1), nf‐
244 stest_xattr(1), nfstest_xid(1), packet.pkt(3), packet.pktt(3),
245 packet.record(3), packet.utils(3)
246
249 No known bugs.
250
252 Jorge Mora (mora@netapp.com)
253NFStest 3.2 21 March 2023 NFSTEST_PKT(1)