This is our old Q&A Site. Please post any new questions and answers at

When analyzing wireshark data, none of the NFS path/filenames are available even after selecting the option to show full path and file name. How can I see the full NFS path and file name that was accessed? Please advise.

Additional data. NFS v3, source data is on NetApp running Ontap 7.1.x; wireshark capturing NFS data on port 2049 from Linux SLES10 client (autofs). I can see all access,getattr,setattr, etc. i need to figure out how to see each NFS path/filename (full path & file name)


asked 09 Oct '10, 09:53

debugme's gravatar image

accept rate: 0%

edited 09 Oct '10, 09:57

You can only see the full pathname for a file if:

  • for a request that includes a file name (LOOKUP, REMOVE, RENAME, CREATE, etc.), replies that provide the file names of all directories in the path of the directory in which that request was done appear in the capture before the request in question;

  • for a request that includes only a file handle (ACCESS, GETATTR, SETATTR, etc.), replies that provide the file names of all those directories and the file to which the file handle refers appear in the capture appear in the capture before the request in question.

In general, there's no guarantee that you can see the full path name - or even just the file name - corresponding to a given file handle in an arbitrary capture. That's just how NFS works.

permanent link

answered 10 Oct '10, 13:50

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

edited 10 Oct '10, 13:51

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 09 Oct '10, 09:53

question was seen: 7,159 times

last updated: 10 Oct '10, 13:51

p​o​w​e​r​e​d by O​S​Q​A