Reducing a pcap file down to all operations on a specific NFS file

Question

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.

How can I accomplish this?

I know the following facts about what I want to capture (in tshark display format):

nfs.name == ".o1_mf_1_1093__1366653401581181_.arc
nfs.fh.hash == 0x5c191ad8
nfs.fhandle == 3a:4f:47:4c:20:11:7b:48:7f:88:4f:16:94:90:a0:34:9a:fa:cf:71:e1:6a:95:fc:3e:3b:4e:6a:bb:9c:c6:c4:49:db:80:ca

But I don't know how to tell tshark to give me the applicable requests/replies/etc.

I've tried:

tshark -r ginormous.pcap -w 1366653401581181.pcap \
    -R "nfs.fh.hash == 0x5c191ad8" \
    -o nfs.file_name_snooping:TRUE \
    -o nfs.file_full_name_snooping:TRUE \
    -o nfs.fhandle_find_both_reqrep:TRUE

to try and coax tshark to do the snooping that the full GUI would do, but but no avail.

score 1 · Answer 1 · answered Apr 22 '13 at 19:23

1

With tshark -r nfs.pcap -R 'nfs.fh.hash == 0x5c191ad8' you can get all requests or reply with fh. For more complicated cases I guess you need to write some code. There is a great tool for that http://git.linux-nfs.org/?p=mora/nfstest.git;a=summary

answered Apr 22 '13 at 19:23

kofemann

4,308
1
21
27

This only actually gets you one end of it. And [not even entire packets](http://imgur.com/4m1z1lg) :( – MikeyB Apr 22 '13 at 20:21
how much packets do you expect? you can get involved XIDs and then filter once more only to select them (all calls and reply) – kofemann Apr 22 '13 at 21:31
Yes, that's the approach I took. It'll only probably end up being around 10GB of data. – MikeyB Apr 22 '13 at 21:36
some time ago I was working on similar problem and created a small tool. may be you can re-use it: https://github.com/kofemann/nfs-pycap – kofemann Apr 22 '13 at 21:44

score 1 · Answer 2 · answered Apr 22 '13 at 21:35

Work in progress:

tshark -r $BIGFILE -T fields -e rpc.xid -R "nfs.fh.hash == 0x5c191ad8" | \
   tshark -r $BIGFILE -R "$(\
       python -c 'import sys; xids = sys.stdin.readlines(); print("||".join(["rpc.xid=={0}".format(xid.strip()) for xid in xids]))'\
   )"

Reducing a pcap file down to all operations on a specific NFS file

2 Answers2