How to set up a "lan trace"

[Charles Holland]

In trying to resolve a problem between DataProtector and a linux box running SuSE SLES 10 with (now) SP3 Novell has asked "Can you start a lan trace on the HP server,". My first thought was HUH?

Is that anything like using traceroute?

the thing is aborting trying to resolve gethostbyname on the linux box. Ws working FINE before I put in SP3 on the 10th of December.

Thanks in advance.

[Tingli]

How about tcpdump?

[Steven E. Protter]

Shalom,

I would think tcpdump or wireshark would do the job.

Wireshark is available free on Linux and on http://software.hp.com for HP-UX which is where you posted.

SEP

[Bill Hassell]

DP is painfully tied to exact hostnames and IP addresses in both directions. Both the HP-UX side and the Linux side need to resolve the same name and the same IP address. DNS and local /etc/hosts can cause this issue as well as updates to the way the resolver works. Using domain names for local machines can create problems too. Use both nslookup and nsquery on the HP side.

A LAN trace on the HP side is via nettl. Wireshark is the tool of choice to format and view the trace and it knows more than 400 logfile formats. Note that when running Wireshark on a PC to look at the traffic, you'll need a dumb hub -- switches will block traffic from other connections.

[Charles Holland]

I simply want to monitor and log to a file for about 5 - 8 minutes and then give the file to the tech support for them to review.

Would that be to use nettl if it has logging.

[Bill Hassell · Accepted solution]

nettl's man page is extremely copmplex for non-network gurus. Assuming you have a relatively small system, here is a 1-liner that will get you a log file:

nettl -tn all -e all -mem 8192 -tm 99999 -f /var/tmp/dplog

This will start running and creating a file called: /var/tmp/dplog.TRC000. If your network (all LAN cards) are very busy, this file can grow very fast. If the file gets into the dozens of megabytes, you'll need to stop the trace:

nettl -traceoff -e all

The resultant file (/var/tmp/dplog.TRC000) is a binary file that Wireshark can read. Send that file to Novell. If they ask "What is a nettl log file?" tell them to use Wireshark to read it. If they don't have Wireshark, you can format the file with this command:

netfmt -N -n -l -f /var/tmp/dplog.TRC000 > /var/tmp/nettl.log

This will be an ASCII file which you can look at then send it to Novell.

[Charles Holland]

closed