This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

High NFS READ latency from SLES10 client to EMC Clarion filer

0

I have a tshark trace dump and want to see the human readable time stamps between NFS READ procedure calls/packets. I understand frame.time_delta might be a good filter expression?

Can anyone provide a command line example on how to do this running tshark. I have the RTT stats and READ procedure has very heavy latency so I want to drill down and see if I can understand which file handle(s) might be responsible.

Any help is very much appreciated.

thanks

asked 26 Jan '11, 18:04

debugme's gravatar image

debugme
6336
accept rate: 0%

hi

Thank you for your response. I will use your filter and see what the results are. Thank you again.

(07 Feb '11, 09:49) debugme

One Answer:

2

I used the following before to get a grasp on which NFS calls were taking a lot of time:

tshark -o tcp.desegment_tcp_streams:FALSE -nlr nfs.cap -R rpc -qzio,stat,300,\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==1",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==1",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==1",\
    "COUNT(rpc.time)rpc.time&&rpc.procedure==2",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==2",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==2",\
    [...]
    "COUNT(rpc.time)rpc.time&&rpc.procedure==21",\
    "AVG(rpc.time)rpc.time&&rpc.procedure==21",\
    "MAX(rpc.time)rpc.time&&rpc.procedure==21"

If you want to drill down, you might want to use something like:

tshark -nlr nfs.cap -R "rpc.time>0.5"

answered 27 Jan '11, 10:37

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%