High NFS READ latency from SLES10 client to EMC Clarion filer

Question

I have a tshark trace dump and want to see the human readable time stamps between NFS READ procedure calls/packets. I understand frame.time_delta might be a good filter expression?

Can anyone provide a command line example on how to do this running tshark. I have the RTT stats and READ procedure has very heavy latency so I want to drill down and see if I can understand which file handle(s) might be responsible.

Any help is very much appreciated.

thanks

Answer 1

I used the following before to get a grasp on which NFS calls were taking a lot of time:

tshark -o tcp.desegment_tcp_streams:FALSE -nlr nfs.cap -R rpc -qzio,stat,300,\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==1",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==1",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==1",\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==2",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==2",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==2",\
    [...]
    "COUNT(rpc.time)rpc.time&&rpc.procedure==21",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==21",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==21"

If you want to drill down, you might want to use something like:

tshark -nlr nfs.cap -R "rpc.time>0.5"