Pillar Axiom: How to Use the tcpdump command

Asset ID:	1-71-1389672.1
Update Date:	2012-08-29
Keywords:

Solution Type Technical Instruction Sure

Solution 1389672.1 : Pillar Axiom: How to Use the tcpdump command

Applies to:

Pillar Axiom 600 Storage System - Version Not Applicable to Not Applicable [Release N/A]
Information in this document applies to any platform.

Goal

The tcpdump command performs a packet capture for UNIX systems.

When asked to collect a tcpdump in order to troubleshoot an issue with a UNIX client you must first know which ethernet port on the host which you will be monitoring. The name of the ethernet port can be found by using the ifconfig command. This name can then be used within the tcpdump syntax.

Fix

ifconfig is used in the sample below to determine the network interface that will be monitored on the host.



# ifconfig 

eth0 Link encap:Ethernet HWaddr 00:03:47:98:78:0A

inet addr:192.168.0.1 Bcast: 192.168.0.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:20130985 errors:0 dropped:0 overruns:0 frame:0

TX packets:2140879 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:100

RX bytes:2469919130 (2355.4 Mb) TX bytes:267848744 (255.4 Mb)

Interrupt:17 Memory:fe000000-fe020000

Note that the <Interface Name> below given the above ifconfig output would be eth0

Note that the <destination IP> below would be the IP of the Axiom VIF that you are having the issue with.

1) Open a terminal to the client system

2) Gather a tcpdump for that interface name using the following syntax:

tcpdump -i <Interface Name> -s 0 -w mount_failure.pcap host <destination IP>

3) Open another terminal to the client system

4) Attempt to recreate the observed problem between the client system and the Axiom while noting the time of this activity.

5) Once recreated, return to the original terminal and press CTRL+C to end the capture.

6) Upload the resulting mount_failure.pcap file to MOS.

Attachments

This solution has no attachment