nettl

[Theo Wawers]

I want to use nettl to trace ICMP packets. It works in principal. But I'm not able to include the source and target ip addresses into the output. The tracing is started on the NS_LS_ICMP subsystem. All trace kinds are active.

How knows ?

Cheers,
Theo

[federico_3]

In order to trace all packets sent by node and addressed to node :

1) start trace putting data into 1MB trace file ( /tmp/raw.TRC0, raw.TRC1).
/etc/nettl -tn -pduin -pduout -e all -f /tmp/raw

2) stop trace -> /etc/nettl -tf -e all
3) Format traces into a file like this :

/etc/netfmt -N -n -l -f /tmp/raw.TRC0 > /tmp/file0

/etc/netfmt -N -n -l -f /tmp/raw.TRC1 > /tmp/file1


-n option -> print IP addresses, not hostnames



I hope this helps

Federico

[Theo Wawers]

This doesn't solve the problem completely.
I did the sample with:
/etc/nettl -tn all -e NS_LS_ICMP -f /tmp/raw
alnd the formatting with:
/etc/netfmt -N -n -l -f /tmp/raw.TRC0

The output didn't contain neither the source nor the dest IP addresses.

Who can help....

Theo

[federico_3]

I've tried
/etc/nettl -tn all -e ns_ls_icmp /tmp/raw
and i get nothing.

I've searched in the man nettl and i have not found anything about the subsystem ns_ls_icmp. ( using ns_ls_ip i find something interesting even about the ip address ).

Try to search all subsystems with the option "-e all" and see if it's OK.