debugging a tcp socket connection

[Mark Greene_1]

Is there a debugger or log file that I can use to examine the traffic for a tcp socket connection, or do I have to use a sniffer?

I am trying to get a xyplex terminal server to connect to my L2000 running 11.0. The counters on the port on the xyplex show that the output count and remote connect increase, but the input count remains at zero.

grepping the netstat -a output for the IP address of the termserver show multiple connections in TIME_WAIT and one ESTABLISHED. Repeated runs shows that the ESTABLISHED session eventually dies (timeout?) and the next connection in the list goes from TIME_WAIT to ESTABLISHED and repeats the cycle.

I am wanting to be able to determine if it is the terminal server that is failing the connection, or the application on the HP so I know which vendor to call.

Thanks,
mark

[Daimian Woznick · Accepted solution]

You may find the following tools useful:

libpcap (required for the utilities listed below)
A system-independent interface for packet capture. It provides a portable framework for low-level network monitoring in the form of a include files and a library that be linked against, as is done with the tcpdump package.
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/libpcap-0.6.2/

tcpdump
A tool for network monitoring and data acquisition. It is loosely based on SMI's etherfind utility but has been extensively rewritten so that none of the original code remains. It uses the includes and library from the libpcap package, which must be obtained and installed first before installing tcpdump itself.
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpdump-3.7.1/

nstreams
A program that analyses the networks streams. Nstreams analyses the networks streams occurring on a network and prints them in a human readable form. This is useful when you want to set up a firewall but do not know the needs of your customers. Nstreams can read tcpdump output files or directly listen on a given interface.
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/nstreams-1.0.2/

tcptrace
A TCP connection log analysis tool. Tcptrace takes a tcpdump file specified on the command line and produces a summary of the connections. It can create output suitable for throughput graphs, rtt sample graphs, time sequence graphs and more. It also has extensive connection filtering options.
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/tcptrace-5.2.1/

tcpflow
Capture transmitted data on TCP flows. Tcpflow captures data transmitted as part of TCP connections, and stores it in a way that is convenient for protocol analysis. It reconstructs the actual data streams and stores each flow in a separate file for later analysis.
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcpflow-0.20/

All of the above are available from the porting center.

[A. Clay Stephenson]

I don't think you have any choice but to use some sort of traffic analyzer to get much more data than netstat will reveal unless the application has a debug/logging mode that you can enable.

One of the best freely available analyzers is 'ethereal' and it has a very good GUI. You can easilt setup filters to monitor only the packets you are interested in.

http://hpux.cs.utah.edu/hppd/hpux/Gtk/Applications/ethereal-0.9.4/

Warning: It does have a large number of dependencies so make certain than you swinstall them all.

[Bill McNAMARA_1]

See if you can get anything from nettladm
It's a GUI, so export your display appropriately.
The raw logs may show something.

Later,
Bill

[Mark Greene_1]

Thanks to all who replied. Tcpdump is what I was having a brainfreeze over, but Bill's suggestion was great too. I will make some time to check out the others, they look good too.

mark