Filtering on NFSv3 procedures

I was asked to figure out why a NFSv3 server was not responding to READDIR requests. Note, I don’t know if this was READDIR or READDIRPLUS. I fired off tshark to capture packets:

tshark -i any -w /tmp/bonds.scp 

Hmm, even when filtering on NFS, too many packets to examine (it is a very busy NFSv3 server):

NR_09-20:24:09 pixie ~ $ tshark -r /tmp/bonds.scp | wc -l
Running as user "root" and group "root". This could be dangerous.
NR_09-20:29:13 pixie ~ $ tshark -r /tmp/bonds.scp -Y nfs | wc -l
Running as user "root" and group "root". This could be dangerous.

I could use Wireshark, but nah!

I can use a better filter:

NR_09-20:31:46 pixie ~ $ tshark -r /tmp/bonds.scp -Y "nfs.procedure_v3  == 16 || nfs.procedure_v3  == 17" | wc -l
Running as user "root" and group "root". This could be dangerous.

This states to only filter if the NFSv3 procedure is either 16 or 17.

You can find the list of NFSv3 procedures at

OS X will create sparse files across NFS, or does it?

KinMage:src thomas$ sudo mount -o vers=3,intr /mnt
KinMage:src thomas$ ls -la /mnt
total 8
drwxrwxrwx   2 root  wheel  4096 Feb 13 21:50 .
drwxrwxr-t  24 root  admin  1224 Feb 13 21:54 ..

Where is snakey, the Linux VM I am using for testing.

And then:

KinMage:mnt thomas$ python 
KinMage:mnt thomas$ ls -la p*out
-rw-r--r--  1 thomas  staff    1023 Feb 13 21:54 p1023.out
-rw-r--r--  1 thomas  staff    1024 Feb 13 21:54 p1024.out
-rw-r--r--  1 thomas  staff    1025 Feb 13 21:54 p1025.out
-rw-r--r--  1 thomas  staff   10250 Feb 13 21:54 p10250.out
-rw-r--r--  1 thomas  staff  102500 Feb 13 21:54 p102500.out
-rw-r--r--  1 thomas  staff      64 Feb 13 21:54 p64.out
KinMage:mnt thomas$ du -sh p*out
1.0K	p1023.out
1.0K	p1024.out
1.5K	p1025.out
 10K	p10250.out
100K	p102500.out
512B	p64.out

So it creates sparse files across NFS!

Well, yes and no. It will only send a block of data across and then the
server OS decides to create the sparse file or not.

Another thing to note is that the size reported is flexible in the sense
that the underlying file system interface determines how much space
is being reported:

[thomas@snakey fooper]$ du -sh p*out
4.0K	p1023.out
4.0K	p1024.out
4.0K	p102500.out
4.0K	p10250.out
4.0K	p1025.out
4.0K	p64.out

Ideally we would like the sizes to match, but since we are pulling a fast one, we get what we see.

How to mount nfsv4 from Snow Leopard

KinMage:~ tdh$ sudo mount -o vers=4 /mnt
mount_nfs: sorry, you must specify vers=4.0alpha to use the alpha-quality NFSv4 support
KinMage:~ tdh$ sudo mount -o vers=4.0alpha /mnt
KinMage:~ tdh$ ls -la /mnt
total 23952
drwxr-xr-x   2 root  220776704     4096 Oct  7 17:31 .
drwxrwxr-t  32 root  admin         1156 Oct  4 14:01 ..
-rwxr-xr-x   1 root  daemon     1455680 Oct  7 17:31 img_0132.jpg
-rwxr-xr-x   1 root  daemon     1698991 Oct  7 17:31 img_0135.jpg
-rwxr-xr-x   1 root  daemon     1539525 Oct  7 17:31 img_0136.jpg
-rwxr-xr-x   1 root  daemon     1522669 Oct  7 17:31 img_0137.jpg
-rwxr-xr-x   1 root  daemon     1524863 Oct  7 17:31 img_0138.jpg
-rwxr-xr-x   1 root  daemon     1459397 Oct  7 17:31 img_0140.jpg
-rwxr-xr-x   1 root  220776704  1505265 Oct  7 17:31 img_0141.jpg
-rwxr-xr-x   1 root  daemon     1470002 Oct  7 17:31 img_0143.jpg