Managing NFS and NIS, 2nd Edition - Mike Eisler [203]
# tethereal -r /tmp/capture -R "frame.number == 56"
56 2.309622 caramba -> mickey NFS V3 LOOKUP Call XID 0x590289e8
This is equivalent to snoop's -p option. You can also specify ranges of values of a field. For example, you can print the first three packets in the capture file by specifying a range for frame.number:
# tethereal -r /tmp/capture -R "frame.number <= 3"
1 0.000000 caramba -> mickey PORTMAP V2 GETPORT Call XID 0x39c87b6e
2 0.000728 mickey -> caramba PORTMAP V2 GETPORT Reply XID 0x39c87b6e
3 0.001500 caramba -> mickey NFS V3 NULL Call XID 0x39c87b6f
You can combine basic filter expressions and field values by using logical operators to build more powerful filters. For example, say you want to list all NFS Version 3 Lookup and Getattr operations. You know that NFS is an RPC program, therefore you first need to determine the procedure number for the NFS operations by finding their definition in the nfs.h include file:
$ grep NFSPROC3_LOOKUP /usr/include/nfs/nfs.h
#define NFSPROC3_LOOKUP ((rpcproc_t)3)
$ grep NFSPROC3_GETATTR /usr/include/nfs/nfs.h
#define NFSPROC3_GETATTR ((rpcproc_t)1)
The two grep operations help you determine that the NFS Lookup operation is RPC procedure number 3 of the NFS Version 3 protocol, and the NFS Getattr operation is procedure number 1. You can then use this information to build a filter that specifies your interest in protocol NFS with RPC program Version 3, and RPC procedures 1 or 3. You can represent this with the filter expression:
nfs and rpc.programversion == 3 and(rpc.procedure == 1 or rpc.procedure == 3)
The tethereal invocation follows:
# tethereal -r /tmp/capture -R "nfs and rpc.programversion == 3 and \
(rpc.procedure == 1 or rpc.procedure == 3)"
54 2.307132 caramba -> schooner NFS V3 GETATTR Call XID 0x590289e7
55 2.308824 schooner -> caramba NFS V3 GETATTR Reply XID 0x590289e7
56 2.309622 caramba -> mickey NFS V3 LOOKUP Call XID 0x590289e8
57 2.310400 mickey -> caramba NFS V3 LOOKUP Reply XID 0x590289e8
The filter displays all NFS Version 3 Getattr and all NFS Version 3 Lookup operations. Refer to tethereal 's documentation for a complete description of the rich filters provided. In Chapter 14, you will see how to use tethereal to debug NFS- related problems.
* * *
[9] In our examples, we reformat the output that tethereal generates by adding or removing white spaces to make it easier to read.
Chapter 14. NFS Diagnostic Tools
The previous chapter described diagnostic tools used to trace and resolve network and name service problems. In this chapter, we present tools for examining the configuration and performance of NFS, tools that monitor NFS network traffic, and tools that provide various statistics on the NFS client and server.
NFS administration tools
NFS administration problems can be of different types. You can experience problems mounting a filesystem from a server due to export misconfiguration, problems with file permissions, missing information, out-of-date information, or severe performance constraints. The output of the NFS tools described in this chapter will serve as input for the performance analysis and tuning procedures in Chapter 17.
Mount information is maintained in three files, as shown in Table 14-1.
Table 14-1. Mount information files
File
Host
Contents
/etc/dfs/sharetab
server
Currently exported filesystems
/etc/rmtab
server
host:directory name pairs for clients of this server
/etc/mnttab
client
Currently mounted filesystems
An NFS server is interested in the filesystems (and directories within those filesystem) it has exported and what clients have mounted filesystems from it. The /etc/dfs/sharetab file contains a list of the current exported filesystems and under normal conditions, it reflects the contents of the /etc/dfs/dfstab file line-for-line.
The existence of /etc/dfs/dfstab usually determines whether a machine becomes an NFS server and runs the mountd and nfsd daemons. During the boot process, the server checks for this file and executes the shareall script which, in turn,