There are many tools for observing the activity, both normal and pathological, on the network. Some run under AIX, others run on dedicated hardware. One tool that can be used to obtain a detailed, packet-by-packet description of the LAN activity generated by a workload is the combination of the iptrace daemon and the ipreport command. The iptrace daemon can only be started by root.
By default, iptrace traces all packets. An option (-a) allows exclusion of address resolution protocol (ARP) packets. Other options can narrow the scope of tracing to a particular source host (-s), destination host (-d), or protocol (-p). See AIX Version 4.3 Commands Reference. Because iptrace can consume significant amounts of processor time, you should be as specific as possible in describing the packets you want traced.
Since iptrace is a daemon, it should be started with a startsrc command rather that directly from the command line. This makes it easier to control and shut down cleanly. A typical invocation would be:
# startsrc -s iptrace -a "-i tr0 /home/user/iptrace/log1"
This command starts the iptrace daemon with directions to trace all activity on the Token-Ring interface, tr0, and place the trace data in /home/user/iptrace/log1. To stop the daemon, use:
# stopsrc -s iptrace
If you hadn't started it with startsrc, you would have to find its process ID with ps and kill it.
The ipreport command is a formatter for the log file. Its output is written to stdout. Options allow recognition and formatting of RPC packets (-r), identifying each packet with a number (-n), and prefixing each line with a 3-character string that identifies the protocol (-s). A typical ipreport command to format the log1 file just created (which is owned by root) would be:
# ipreport -ns log1 >log1_formatted
This would result in a sequence of packet reports similar to the following examples. The first packet is the first half of a ping. The fields of most interest are: the source (SRC) and destination (DST) host address, both in dotted decimal and in ASCII; the IP packet length (ip_len); and the indication of the higher-level protocol in use (ip_p).
Packet Number 131 TOK: =====( packet transmitted on interface tr0 )=====Fri Dec 10 08:42:07 1993 TOK: 802.5 packet TOK: 802.5 MAC header: TOK: access control field = 0, frame control field = 40 TOK: [ src = 90:00:5a:a8:88:81, dst = 10:00:5a:4f:35:82] TOK: routing control field = 0830, 3 routing segments TOK: routing segments [ ef31 ce61 ba30 ] TOK: 802.2 LLC header: TOK: dsap aa, ssap aa, ctrl 3, proto 0:0:0, type 800 (IP) IP: < SRC = 129.35.145.140 > (alborz.austin.ibm.com) IP: < DST = 129.35.145.135 > (xactive.austin.ibm.com) IP: ip_v=4, ip_hl=20, ip_tos=0, ip_len=84, ip_id=38892, ip_off=0 IP: ip_ttl=255, ip_sum=fe61, ip_p = 1 (ICMP) ICMP: icmp_type=8 (ECHO_REQUEST) icmp_id=5923 icmp_seq=0 ICMP: 00000000 2d088abf 00054599 08090a0b 0c0d0e0f |-.....E.........| ICMP: 00000010 10111213 14151617 18191a1b 1c1d1e1f |................| ICMP: 00000020 20212223 24252627 28292a2b 2c2d2e2f | !"#$%&'()*+,-./| ICMP: 00000030 30313233 34353637 |01234567 |
The next example is a frame from an ftp operation. Note that the IP packet is the size of the MTU for this LAN--1492 bytes.
Packet Number 501
TOK: =====( packet received on interface tr0 )=====Fri Dec 10 08:42:51 1993
TOK: 802.5 packet
TOK: 802.5 MAC header:
TOK: access control field = 18, frame control field = 40
TOK: [ src = 90:00:5a:4f:35:82, dst = 10:00:5a:a8:88:81]
TOK: routing control field = 08b0, 3 routing segments
TOK: routing segments [ ef31 ce61 ba30 ]
TOK: 802.2 LLC header:
TOK: dsap aa, ssap aa, ctrl 3, proto 0:0:0, type 800 (IP)
IP: < SRC = 129.35.145.135 > (xactive.austin.ibm.com)
IP: < DST = 129.35.145.140 > (alborz.austin.ibm.com)
IP: ip_v=4, ip_hl=20, ip_tos=0, ip_len=1492, ip_id=34233, ip_off=0
IP: ip_ttl=60, ip_sum=5ac, ip_p = 6 (TCP)
TCP: <source port=20(ftp-data), destination port=1032 >
TCP: th_seq=445e4e02, th_ack=ed8aae02
TCP: th_off=5, flags<ACK |>
TCP: th_win=15972, th_sum=0, th_urp=0
TCP: 00000000 01df0007 2cd6c07c 00004635 000002c2 |....,..|..F5....|
TCP: 00000010 00481002 010b0001 000021b4 00000d60 |.H........!....`|
--------- Lots of uninteresting data omitted -----------
TCP: 00000590 63e40000 3860000f 4800177d 80410014 |c...8`..H..}.A..|
TCP: 000005a0 82220008 30610038 30910020 |."..0a.80.. |