Establish a snoop system off a hub that is connected to either the client or server.
The third system (the snoop system) checks all the intervening traffic, so the snoop trace reflects what is actually happening on the wire.
On the command line, type snoop with options and save to a file.
Inspect and interpret results.
Look at RFC 1761 for details of the snoop capture file.
Use snoop frequently and consistently to become familiar with normal system behavior. For assistance in analyzing packets, look for a recent white paper and RFC, and seek the advice of an expert in a particular area, such as NFS or YP. For details on using snoop and its options, refer to the snoop(1M) man page.