Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.

How can I accomplish this?

I know the following facts about what I want to capture (in tshark display format): == ".o1_mf_1_1093__1366653401581181_.arc
nfs.fh.hash == 0x5c191ad8
nfs.fhandle == 3a:4f:47:4c:20:11:7b:48:7f:88:4f:16:94:90:a0:34:9a:fa:cf:71:e1:6a:95:fc:3e:3b:4e:6a:bb:9c:c6:c4:49:db:80:ca

But I don't know how to tell tshark to give me the applicable requests/replies/etc.

I've tried:

tshark -r ginormous.pcap -w 1366653401581181.pcap \
    -R "nfs.fh.hash == 0x5c191ad8" \
    -o nfs.file_name_snooping:TRUE \
    -o nfs.file_full_name_snooping:TRUE \
    -o nfs.fhandle_find_both_reqrep:TRUE

to try and coax tshark to do the snooping that the full GUI would do, but but no avail.

share|improve this question

With tshark -r nfs.pcap -R 'nfs.fh.hash == 0x5c191ad8' you can get all requests or reply with fh. For more complicated cases I guess you need to write some code. There is a great tool for that;a=summary

share|improve this answer
This only actually gets you one end of it. And not even entire packets :( – MikeyB Apr 22 '13 at 20:21
how much packets do you expect? you can get involved XIDs and then filter once more only to select them (all calls and reply) – kofemann Apr 22 '13 at 21:31
Yes, that's the approach I took. It'll only probably end up being around 10GB of data. – MikeyB Apr 22 '13 at 21:36
some time ago I was working on similar problem and created a small tool. may be you can re-use it: – kofemann Apr 22 '13 at 21:44

Work in progress:

tshark -r $BIGFILE -T fields -e rpc.xid -R "nfs.fh.hash == 0x5c191ad8" | \
   tshark -r $BIGFILE -R "$(\
       python -c 'import sys; xids = sys.stdin.readlines(); print("||".join(["rpc.xid=={0}".format(xid.strip()) for xid in xids]))'\
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.