matthews@cbnewsm.ATT.COM (john.matthews) (09/20/89)
Can anyone tell me how I can identify NFS swap packets using etherfind? I used to be able to do an "etherfind -v -t -proto nd" to see if there were any clients that were swapping across our primary backbone segment of the ethernet, but now that we're running 4.0, I can't. I think I can come up with the correct syntax if someone can tell me if there is a unique byte pattern that is common to every NFS swap packet. Thanks in advance, John Matthews Matthews@Research.ATT.COM
sxn%ingersoll@Sun.COM (Stephen X. Nahm) (09/20/89)
matthews@cbnewsm.ATT.COM (john.matthews) writes: >Can anyone tell me how I can identify NFS swap packets using etherfind? >I used to be able to do an "etherfind -v -t -proto nd" to see if there >were any clients that were swapping across our primary backbone segment >of the ethernet, but now that we're running 4.0, I can't. I think I can >come up with the correct syntax if someone can tell me if there is a >unique byte pattern that is common to every NFS swap packet. "ND" was a low-level protocol that was used for swapping by diskless Suns prior to SunOS 4.0. It has it's own IP protocol type number (just like UDP and TCP have theirs), so it can easily be picked out of the ether by etherfind. "NETdisk" is what Sun sometimes calls diskless operation *without* "ND" (or rather, with NFS). The NFS packets that are used for swapping are identical to those used for any other NFS operation. The only way you can pick out packets used for swapping is to examine the NFS packet. You have to determine the "filehandle" (see NFS protocol spec) of the swap file and look for that. This is not easy, since each NETdisk client has its own swapfile (so there may be a lot of filehandles to remember) and filehandles can change. Also, if you want to see both sides of the swap interaction (call and response) you will have to match up the RPC transmission ids (see RPC protocol spec), since only the call has the filehandle. Steve Nahm sxn@sun.COM or sun!sxn