{"id":340,"date":"2021-10-09T16:35:42","date_gmt":"2021-10-09T20:35:42","guid":{"rendered":"http:\/\/blogs.tulsalabs.com\/?p=340"},"modified":"2025-11-12T02:24:49","modified_gmt":"2025-11-12T06:24:49","slug":"filtering-on-nfsv3-procedures","status":"publish","type":"post","link":"http:\/\/blogs.tulsalabs.com\/?p=340","title":{"rendered":"Filtering on NFSv3 procedures"},"content":{"rendered":"\n<p>I was asked to figure out why a NFSv3 server was not responding to READDIR requests. Note, I don&#8217;t know if this was READDIR or READDIRPLUS. I fired off tshark to capture packets:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tshark -i any -w \/tmp\/bonds.scp <\/code><\/pre>\n\n\n\n<p>Hmm, even when filtering on NFS, too many packets to examine (it is a very busy NFSv3 server):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NR_09-20:24:09 pixie ~ $ tshark -r \/tmp\/bonds.scp | wc -l\nRunning as user \"root\" and group \"root\". This could be dangerous.\n140532\nNR_09-20:29:13 pixie ~ $ tshark -r \/tmp\/bonds.scp -Y nfs | wc -l\nRunning as user \"root\" and group \"root\". This could be dangerous.\n39350<\/code><\/pre>\n\n\n\n<p>I could use Wireshark, but nah!<\/p>\n\n\n\n<p>I can use a better filter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NR_09-20:31:46 pixie ~ $ tshark -r \/tmp\/bonds.scp -Y \"nfs.procedure_v3  == 16 || nfs.procedure_v3  == 17\" | wc -l\nRunning as user \"root\" and group \"root\". This could be dangerous.\n21<\/code><\/pre>\n\n\n\n<p>This states to only filter if the NFSv3 procedure is either 16 or 17.<\/p>\n\n\n\n<p>You can find the list of NFSv3 procedures at <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc1813#page-27\">https:\/\/datatracker.ietf.org\/doc\/html\/rfc1813#page-27<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was asked to figure out why a NFSv3 server was not responding to READDIR requests. Note, I don&#8217;t know if this was READDIR or READDIRPLUS.&#46;&#46;&#46;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17,37],"tags":[38,39],"class_list":["post-340","post","type-post","status-publish","format-standard","hentry","category-nfs","category-tshark","tag-nfsv3","tag-tshark"],"_links":{"self":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=340"}],"version-history":[{"count":1,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/340\/revisions"}],"predecessor-version":[{"id":341,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/340\/revisions\/341"}],"wp:attachment":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}