Archive for the ‘tricks’ Category

Using xargs to apply tshark to many capture files

Thursday, October 21st, 2010

pktt on a filer can capture for all network interfaces on a head. In order to quickly determine which have relevant data, we can use xargs:

KinMage:csiqa-6080-15 thomas$ ls -1 *021* | xargs -I {} -t tshark -R nfs -r {}
tshark -R nfs -r e0a_20101021_090354.trc
tshark -R nfs -r e0b_20101021_090354.trc
tshark -R nfs -r e0c_20101021_090354.trc
tshark -R nfs -r e0d_20101021_090354.trc
tshark -R nfs -r e0e_20101021_090354.trc
122   0.265844 10.227.74.89 -> 10.227.67.203 NFS V4 COMPOUND Call <EMPTY> PUTFH;CLOSE;GETATTR
123   0.267673 10.227.67.203 -> 10.227.74.89 NFS V4 COMPOUND Reply (Call In 122) <EMPTY> PUTFH;CLOSE
tshark -R nfs -r e0f_20101021_090354.trc
tshark -R nfs -r e4a_20101021_090354.trc
tshark -R nfs -r lo_20101021_090354.trc
tshark -R nfs -r losk_20101021_090354.trc
KinMage:csiqa-6080-15 thomas$ cd ../csiqa-6080-16/
KinMage:csiqa-6080-16 thomas$ ls -1 *021* | xargs -I {} -t tshark -R nfs -r {}
tshark -R nfs -r e0a_20101021_090347.trc
tshark -R nfs -r e0b_20101021_090347.trc
tshark -R nfs -r e0c_20101021_090347.trc
tshark -R nfs -r e0d_20101021_090347.trc
tshark -R nfs -r e4a_20101021_090347.trc
tshark -R nfs -r lo_20101021_090347.trc
tshark -R nfs -r losk_20101021_090347.trc

So we see the first head saw NFS traffic on e0e, but the second saw none.

Getting tshark installed on Mac OS X

Thursday, October 21st, 2010

Download  the wireshark .dmg and open it up.

Then copy the command line files to a location in your path:


512  sudo mkdir /usr/local/bin
513  sudo cp /Volumes/Wireshark/Utilities/Command\ Line/* /usr/local/bin

tshark, my new favorite command line tool

Wednesday, October 20th, 2010

[thomas@godwit ~]> tshark -R nfs -r e4a_20101020_223437.trc
9   1.020806 10.225.212.66 -> 10.225.212.116 NFS V4 NULL Call
10   1.020972 10.225.212.116 -> 10.225.212.66 NFS V4 NULL Reply (Call In 9)