{"id":75,"date":"2010-10-21T14:52:04","date_gmt":"2010-10-21T18:52:04","guid":{"rendered":"http:\/\/blogs.tulsalabs.com\/?p=75"},"modified":"2025-11-12T02:24:50","modified_gmt":"2025-11-12T06:24:50","slug":"using-xargs-to-apply-tshark-to-many-capture-files","status":"publish","type":"post","link":"http:\/\/blogs.tulsalabs.com\/?p=75","title":{"rendered":"Using xargs to apply tshark to many capture files"},"content":{"rendered":"<p>pktt on a filer can capture for all network interfaces on a head. In order to quickly determine which have relevant data, we can use xargs:<\/p>\n<pre>KinMage:csiqa-6080-15 thomas$ ls -1 *021* | xargs -I {} -t tshark -R nfs -r {}\r\ntshark -R nfs -r e0a_20101021_090354.trc\r\ntshark -R nfs -r e0b_20101021_090354.trc\r\ntshark -R nfs -r e0c_20101021_090354.trc\r\ntshark -R nfs -r e0d_20101021_090354.trc\r\ntshark -R nfs -r e0e_20101021_090354.trc\r\n122 \u00c2\u00a0 0.265844 10.227.74.89 -&gt; 10.227.67.203 NFS V4 COMPOUND Call &lt;EMPTY&gt; PUTFH;CLOSE;GETATTR\r\n123 \u00c2\u00a0 0.267673 10.227.67.203 -&gt; 10.227.74.89 NFS V4 COMPOUND Reply (Call In 122) &lt;EMPTY&gt; PUTFH;CLOSE\r\ntshark -R nfs -r e0f_20101021_090354.trc\r\ntshark -R nfs -r e4a_20101021_090354.trc\r\ntshark -R nfs -r lo_20101021_090354.trc\r\ntshark -R nfs -r losk_20101021_090354.trc\r\nKinMage:csiqa-6080-15 thomas$ cd ..\/csiqa-6080-16\/\r\nKinMage:csiqa-6080-16 thomas$ ls -1 *021* | xargs -I {} -t tshark -R nfs -r {}\r\ntshark -R nfs -r e0a_20101021_090347.trc\r\ntshark -R nfs -r e0b_20101021_090347.trc\r\ntshark -R nfs -r e0c_20101021_090347.trc\r\ntshark -R nfs -r e0d_20101021_090347.trc\r\ntshark -R nfs -r e4a_20101021_090347.trc\r\ntshark -R nfs -r lo_20101021_090347.trc\r\ntshark -R nfs -r losk_20101021_090347.trc<\/pre>\n<p>So we see the first head saw NFS traffic on e0e, but the second saw none.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>pktt on a filer can capture for all network interfaces on a head. In order to quickly determine which have relevant data, we can use xargs:&#46;&#46;&#46;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-75","post","type-post","status-publish","format-standard","hentry","category-tricks"],"_links":{"self":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/75","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=75"}],"version-history":[{"count":6,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/75\/revisions"}],"predecessor-version":[{"id":381,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/75\/revisions\/381"}],"wp:attachment":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=75"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=75"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=75"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}