Using nettl to view packets on the fly

[Marco Shaw_1]

From google:

"How to Run nettl+netfmt to Observe Packets "On the Fly:

This is an interactive trace that displays the trace file on the screen, and tee's the output to a file. Make sure you make a specific filterfile first, and specify the appropriate driver in the -e parameter:

# nettl -tn 0x30800000 -e ns_ls_driver | netfmt -F -N -n -l -c filterfile | tee /tmp/fmt0
Don't forget your filterfile. Here is an example:

filter ip_saddr 192.9.9.1
filter ip_daddr 192.9.9.1"

But I just keep getting this error:

"netfmt EOF detected while reading file header. (200)
Check the input filename and try again."

Anyone ever tried to do a 'running' trace like this before? I've checked and re-checked the filterfile syntax, and it looks like it follows the proper format.

[Steven E. Protter]

Shalom,

I find tcpdump is a bit more useful.

Generally you run nettl for a while and then stop it, collecting you data to a file.

I suggest a simpler test, collecting all traffic and then using grep to see what you wish.

SEP

[spex]

Hi Marco,

Consider installing Wireshark (nee Ethereal) on your Windows/Linux workstation. Wireshark will run in promiscuous mode, and will accomplish what you want, as long as your workstation is part of the same collision domain as your servers.

PCS