This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a tshark trace dump and want to see the human readable time stamps between NFS READ procedure calls/packets. I understand frame.time_delta might be a good filter expression?

Can anyone provide a command line example on how to do this running tshark. I have the RTT stats and READ procedure has very heavy latency so I want to drill down and see if I can understand which file handle(s) might be responsible.

Any help is very much appreciated.

thanks

asked 26 Jan '11, 18:04

debugme's gravatar image

debugme
6336
accept rate: 0%

hi

Thank you for your response. I will use your filter and see what the results are. Thank you again.

(07 Feb '11, 09:49) debugme

I used the following before to get a grasp on which NFS calls were taking a lot of time:

tshark -o tcp.desegment_tcp_streams:FALSE -nlr nfs.cap -R rpc -qzio,stat,300,\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==1",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==1",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==1",\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==2",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==2",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==2",\
    [...]
    "COUNT(rpc.time)rpc.time&&rpc.procedure==21",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==21",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==21"

If you want to drill down, you might want to use something like:

tshark -nlr nfs.cap -R "rpc.time>0.5"
permanent link

answered 27 Jan '11, 10:37

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×7
×6
×6

question asked: 26 Jan '11, 18:04

question was seen: 3,587 times

last updated: 07 Feb '11, 09:49

p​o​w​e​r​e​d by O​S​Q​A