This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

list open files with ip or machine name

0

I would like to know if there is a way to list the open files in the network - if so can I also list the machine name with it

asked 06 Feb '13, 08:23

gmail's gravatar image

gmail
11112
accept rate: 0%

edited 06 Feb '13, 09:10

grahamb's gravatar image

grahamb ♦
19.8k330206

Do you mean "list, on a client machine, what files it has open on various file servers" or "list, on a server machine, what client machines have what files open on it"? (Note that the machine on your desk could be a "server" if it's exporting NFS/SMB/AFP/etc. files.) In either case, Wireshark isn't the right tool, as grahamb notes.

(06 Feb '13, 13:57) Guy Harris ♦♦

2 Answers:

1

Not with Wireshark. For certain network file system protocols Wireshark can display the commands to open files if they are present at the time and location of capture, but that probably isn't reflective of the current state of file use though-out the "network", particularly if the capturing machine is on a switched network and not on the actual network file servers.

I think you'll need to look elsewhere for a solution to your problem.

answered 06 Feb '13, 09:16

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

thanks - what tool is out there that you guys know of that can check who has a particular file open in a share network drive. By who I mean the ip or machine name

(06 Feb '13, 19:10) gmail
1

It sounds, from your comment, as if the answer to my question above is "list, on a server machine, what client machines have what files open on it". If so, then there might be a program you can run on the server to report what clients have files open on it. What operating system is the server running, and what file protocol or protocols are being used (NFS, SMB, AFP, Netware, something else)?

(06 Feb '13, 21:35) Guy Harris ♦♦

0

Please check my answer to the following question:

http://ask.wireshark.org/questions/12113/save-the-smb-object-list

It will not show any 'open files', as there is no way (I know of) to do that in Wireshark. It will however list the files that have been accessed on an SMB share. Beware that this may not work in every environment!

Regards
Kurt

answered 07 Feb '13, 16:32

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%