Looking at Selected Packets in a Capture File (pkts)

The statistics show which client is making a read request, and the left column shows the time in seconds, with a resolution of about 4 microseconds.

When a read or write request is made, be sure the server doesn't time-out. If it does, the client has to re-send again, and the client's IP code will break up the write block into smaller UDP blocks. The default write time is .07 seconds. The time-out factor is a tunable parameter in the mount command.

---

Example A-1 Output of the snoop -i pkts -p99, 108 Command

# snoop -i pkts -p99,108
99   0.0027   boutique -> sunroof     NFS C GETATTR FH=8E6C
100   0.0046   sunroof -> boutique     NFS R GETATTR OK
101   0.0080   boutique -> sunroof     NFS C RENAME FH=8E6C MTra00192
to .nfs08
102   0.0102   marmot -> viper          NFS C LOOKUP FH=561E screen.r.13.i386
103   0.0072   viper -> marmot          NFS R LOOKUP No such file or
directory
104   0.0085   bugbomb -> sunroof    RLOGIN C PORT=1023 h
105   0.0005   kandinsky -> sparky    RSTAT C Get Statistics
106   0.0004   beeblebrox -> sunroof  NFS C GETATTR FH=0307
107   0.0021   sparky -> kandinsky    RSTAT R
108   0.0073   office -> jeremiah        NFS C READ FH=2584 at 40960
for 8192

---

The following table describes the arguments to the snoop command.

Table A-3 Arguments to the snoop Command

-i pkts	Displays packets previously captured in the pkts file
-p99,108	Selects packets 99 through 108 to be displayed from a capture file; the first number 99, is the first packet to be captured; the last number, 108, is the last packet to be captured; the first packet in a capture file is packet 1

1. To get more information on a packet, type:

   ---

   # snoop -i pkts -v 101
   

   ---

The command snoop -i pkts -v 101 obtains more detailed information on packet 101. Table A-4 describes the command arguments.

Table A-4 Description of Arguments to the snoop -i pkts -v 101 Command

-i pkts	Displays packets previously captured in the pkts file
-v	Verbose mode; prints packet headers in detail for packet 101; use this option only when you need information on selected packets

To view NFS packets, type:

---

# snoop -i pkts rpc nfs and sunroof and boutique
1   0.0000   boutique -> sunroof    NFS C GETATTR FH=8E6C
2   0.0046    sunroof -> boutique   NFS R GETATTR OK
3   0.0080   boutique -> sunroof    NFS C RENAME FH=8E6C MTra00192 to .nfs08

---

This example gives a view of the NFS packets between the systems sunroof and boutique. Table A-5describes the arguments to the previous snoop command.

Table A-5 Arguments to the snoop -i pkts rpc nfs and sunroof and boutique Command

-i pkts	Displays packets previously captured in the pkts file
rpc nfs	Displays packets for an RPC call or reply packet for the NFS protocol; the option following nfs is the name of an RPC protocol from /etc/rpc or a program number
and	Performs a logical and operation between two boolean values; for example, sunroof boutique is the same as sunroof and boutique

1. To save packets to a new capture file, type:

   ---

   # snoop -i pkts -o pkts.nfs rpc nfs sunroof boutique
   

   ---

Table A-6describes the arguments to the previous snoop command.

Table A-6 Description of Arguments to the snoop -i pkts -o.nfs rpc nfs sunroof boutique Command

-i pkts	Displays packets previously captured in the pkts file
-o pkts.nfs	Saves the displayed packets in the pkts.nfs output file
rpc nfs	Displays packets for an RPC call or reply packet for the NFS protocol; the option following nfs is the name of an RPC protocol from /etc/rpc or a program number

See the snoop man page for additional details on options used with the snoop command and additional information about using snoop.