NFSTEST_PKT(1)

💅 NAME 💅

nfstest_pkt — packet trace decoder 🫶 this is the manual page for nfstest_pkt, version 1.4, section 1 of the manual. yes bestie, it's giving networking detective energy and we're obsessed.

---

✨ SYNOPSIS ✨

nfstest_pkt [options] <trace1.cap> [<trace2.cap> ...]

---

🦋 DESCRIPTION 🦋

okay so here's the vibe: nfstest_pkt decodes and displays every single packet in the packet trace file(s) you hand it. the match option is your little search bar, letting you hunt down specific packets inside the trace file. other options let you pull in the corresponding call or reply when only one of the pair matched. and if you only want a slice of the packets, the start and/or end options have you covered. slay. 💅

there are three levels of verbosity, and you set them with a bitmap — the most significant bit gives you the more verbose output. verbose level 1 is the default, where each packet gets condensed down to one line using the last layer of the packet as the main output. and by default, only the NFS packets (NFS, MOUNT, NLM, etc.) are displayed. no cap. ✨

the packet trace files get processed either serially or in parallel. packets are always displayed using their timestamps, so they come out in the correct order even if the files you gave are out of order. iconic behavior honestly. if the packet traces were captured one after the other, the packets are displayed serially — first the packets of the first file according to their timestamps, then the second, and so on. if the packet traces were captured at the same time on multiple clients, the packets are displayed in parallel — packets get interleaved from all the files when displayed, again according to their timestamps. 🌈

Note: when you use the --call option, a packet call can be displayed out of order if the call itself isn't matched explicitly but its reply is matched — because then its corresponding call gets displayed right before the reply. it's giving "we're squeezing you in, bestie" 😭

---

🎀 OPTIONS 🎀

• --version — show program's version number and exit
• -h, --help — show this help message and exit
• -v VERBOSE, --verbose=VERBOSE — verbose level bitmask [default: 1]. here's the breakdown: bitmap 0x01: one line per packet. bitmap 0x02: one line per layer. bitmap 0x04: real verbose. 💅
• -l LAYERS, --layers=LAYERS — layers to display [default: 'rpc']. the valid layers are: ethernet, ip, tcp, udp, rpc, nfs, nlm, mount, portmap
• -s START, --start=START — start index [default: 0]
• -e END, --end=END — end index [default: 0]
• -m MATCH, --match=MATCH — match string [default: True]
• -c, --call — if you're matching a reply packet, include its corresponding call in the output
• -r, --reply — if you're matching a call packet, include its corresponding reply in the output
• -d DISPLAY, --display=DISPLAY — print a specific packet or part of a packet [default: pkt]
• -z TZ, --tz=TZ — time zone to use to display timestamps
• --serial — process packet traces one after the other in the order in which they are given. the default is to open all files first and then display the packets ordered according to their timestamps.
• --progress=PROGRESS — display progress bar [default: 1]

🧚 RPC display 🧚

• --rpc-type=RPC_TYPE — display RPC type [default: True]
• --rpc-load=RPC_LOAD — display RPC load type (NFS, NLM, etc.) [default: True]
• --rpc-ver=RPC_VER — display RPC load version [default: True]
• --rpc-xid=RPC_XID — display RPC xid [default: True]

🍓 Packet display 🍓

• --nfs-mainop=NFS_MAINOP — display NFSv4 main operation only [default: False]
• --load-body=LOAD_BODY — display RPC payload body [default: True]
• --frame=FRAME — display record frame number [default: 0]
• --index=INDEX — display packet number [default: 1]
• --crc16=CRC16 — display CRC16 encoded strings [default: True]
• --crc32=CRC32 — display CRC32 encoded strings [default: True]
• --strsize=STRSIZE — truncate all strings to this size [default: 0]

💀 Debug 💀

• --enum-check=ENUM_CHECK — if set to True, enums are strictly enforced [default: False]
• --enum-repr=ENUM_REPR — if set to True, enums are displayed as numbers [default: False]
• --no-rpc-replies — do not dissect RPC replies
• --debug-level=DEBUG_LEVEL — set debug level messages

---

🌸 EXAMPLES 🌸

here come the examples, bestie, and honestly? they ate. 🔥

display all NFS packets (one line per packet) — only the NFS packets get displayed by default, and the --verbose default is 1, aka one line per packet:

# Display all NFS packets (one line per packet)
# Display only the NFS packets by default.
# Default for --verbose option is 1 -- one line per packet
$ nfstest_pkt /tmp/trace.cap

display all NFS packets, one line per layer:

# Display all NFS packets (one line per layer)
$ nfstest_pkt -v 2 /tmp/trace.cap

display all NFS packets, real verbose — every item in each layer gets displayed:

# Display all NFS packets (real verbose, all items in each layer are
displayed)
$ nfstest_pkt -v 4 /tmp/trace.cap

display all NFS packets with both verbose level 1 and 2:

# Display all NFS packets (display both verbose level 1 and 2)
$ nfstest_pkt -v 3 /tmp/trace.cap

display all TCP packets — heads up, this also displays all the RPC and NFS packets, because layers stack, periodt:

# Display all TCP packets (this will display all RPC and NFS packets as
well)
$ nfstest_pkt -l tcp /tmp/trace.cap

display all packets:

# Display all packets
$ nfstest_pkt -l all /tmp/trace.cap

display all NFS, NLM, MOUNT and PORTMAP packets:

# Display all NFS, NLM, MOUNT and PORTMAP packets
$ nfstest_pkt -l nfs,nlm,mount,portmap /tmp/trace.cap

display packets 100 through 199:

# Display packets 100 through 199
$ nfstest_pkt -s 100 -e 200 -l all /tmp/trace.cap

display all NFS packets with non-zero status:

# Display all NFS packets with non-zero status
$ nfstest_pkt -m "nfs.status != 0" /tmp/trace.cap

display all NFSv4 WRITE packets:

# Display all NFSv4 WRITE packets
$ nfstest_pkt -m "rpc.version == 4 and nfs.op == 38" /tmp/trace.cap

display all NFSv4 WRITE calls:

# Display all NFSv4 WRITE calls
$ nfstest_pkt -m "rpc.version == 4 and nfs.argop == 38" /tmp/trace.cap

display all NFS packets that have a file name of f00000001 (OPEN, LOOKUP, etc.), replies included:

# Display all NFS packets having a file name as f00000001 (OPEN, LOOKUP,
etc.)
# including their replies
$ nfstest_pkt -r -m "nfs.name == 'f00000001'" /tmp/trace.cap

display all NFS packets with non-zero status, plus their respective calls — two ways to do it, both iconic:

# Display all NFS packets with non-zero status including their
respective calls
$ nfstest_pkt -c -m "nfs.status != 0" /tmp/trace.cap
$ nfstest_pkt -d "pkt_call,pkt" -m "nfs.status != 0" /tmp/trace.cap

display all TCP packets, just the TCP layer:

# Display all TCP packets (just the TCP layer)
$ nfstest_pkt -d "pkt.tcp" -l tcp /tmp/trace.cap

display all NFS file handles:

# Display all NFS file handles
$ nfstest_pkt -d "pkt.NFSop.fh" -m "len(nfs.fh) > 0" /tmp/trace.cap

display all RPC packets including the record info (packet number, timestamp, etc.). for verbose level 1 (the default), the "," separator gets converted to a space if all the items are only pkt(.*)? or pkt_call(.*)?:

# Display all RPC packets including the record information (packet
number, timestamp, etc.)
# For verbose level 1 (default) the "," separator will be converted to a
# space if all items are only pkt(.*)? or pkt_call(.*)?
$ nfstest_pkt -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap

same thing but verbose level 2 — here the "," separator gets converted to a new line if all the items are only pkt(.*)? or pkt_call(.*)?:

# Display all RPC packets including the record information (packet
number, timestamp, etc.)
# For verbose level 2 the "," separator will be converted to a new line
if
# all items are only pkt(.*)? or pkt_call(.*)?
$ nfstest_pkt -v 2 -d "pkt.record,pkt.rpc" -l rpc /tmp/trace.cap

display all RPC packets including the record info, using a custom display format:

# Display all RPC packets including the record information (packet
number, timestamp, etc.)
# using the given display format
$ nfstest_pkt -d ">>> record: pkt.record   >>> rpc: pkt.rpc" -l rpc
/tmp/trace.cap

display all packets, truncating every string to 100 bytes — super useful when some packets are huge and you don't need all that data, bestie:

# Display all packets truncating all strings to 100 bytes
# This is useful when some packets are very large and there
# is no need to display all the data
$ nfstest_pkt --strsize 100 -v 2 -l all /tmp/trace.cap

display all NFSv4 packets showing just the main operation of the compound — so like, "WRITE" instead of "SEQUENCE;PUTFH;WRITE":

# Display all NFSv4 packets displaying the main operation of the
compound
# e.g., display "WRITE" instead of "SEQUENCE;PUTFH;WRITE"
$ nfstest_pkt --nfs-mainop 1 -l nfs /tmp/trace.cap

have all CRC16 strings displayed as plain strings:

# Have all CRC16 strings displayed as plain strings
$ nfstest_pkt --crc16 0 /tmp/trace.cap

have all CRC32 strings displayed as plain strings — e.g. unformatted file handles or state ids:

# Have all CRC32 strings displayed as plain strings
# e.g., display unformatted file handles or state ids
$ nfstest_pkt --crc32 0 /tmp/trace.cap

display packets using India time zone — either offset or name, dealer's choice 💜:

# Display packets using India time zone
$ nfstest_pkt --tz "UTC-5:30" /tmp/trace.cap
$ nfstest_pkt --tz "Asia/Kolkata" /tmp/trace.cap

display all packets for all the trace files given — packets come out in order using their timestamps:

# Display all packets for all trace files given
# The packets are displayed in order using their timestamps
$ nfstest_pkt trace1.cap trace2.cap trace3.cap

---

⭐ SEE ALSO ⭐

formatstr(3), nfstest_alloc(1), nfstest_cache(1), nfstest_delegation(1), nfstest_dio(1), nfstest_fcmp(1), nfstest_file(1), nfstest_interop(1), nfstest_io(1), nfstest_lock(1), nfstest_pnfs(1), nfstest_posix(1), nfstest_rdma(1), nfstest_sparse(1), nfstest_ssc(1), nfstest_xattr(1), nfstest_xid(1), packet.pkt(3), packet.pktt(3), packet.record(3), packet.utils(3)

---

😭 BUGS 😭

no known bugs. (not a single one. the way that she's flawless? 💅✨)

---

👑 AUTHOR 👑

Jorge Mora (mora@netapp.com) — king behavior, fr fr 🫶

---

and that's the whole page, bestie! this one came from NFStest 3.2, dated 21 March 2023 🌈 mwah, go decode some packets, you've got this 💖