Use 'pktt' on the filer to collect a packet trace. It's in tcpdump format. You can use ethereal (www.ethereal.org) to read the trace. From that you should be able to find the culprit.
You can use pktt as such: (my comments are in {})
pktt start e0 { this starts tracing e0 } pktt dump { this causes a file to be created with the content of the dump} pktt stop e0 { stops capturing packets on e0 }
THe interface name can be changed to 'all'. There are some other options to pktt. -d <dir> /* Specifies the directory to put trace in */ -b <buffersize> /* How big a buffer to use to capture packets... don't make this too large... never more than 1m */ -i <ipaddr> /* Self explanitory */
There are some other options. You can search for 'pktt' on NOW to get more info.
Aaron
-----Original Message----- From: BrianH@dice.com [mailto:BrianH@dice.com] Sent: Tuesday, January 09, 2001 10:07 PM To: toasters@mathworks.com Subject: Net Stats, where from?
Does anyone know a nice easy way to tell where network traffic is coming from? Something like nfssat -l where you can see that x% of your traffic comes from xxx.xxx.xxx.xxx or something like that? I have tons and tons of writes happending on my 740, which is killing the CPU. The problem is it just started the other day and it is killing the overall performance of the filer. nfsstat -l shows me the number of NFS ops, and none of them seem out of line at all.
Ideas?
--Brian
Or you could use the option
options nfs.per_client_stats.enable on
Wait a while (say 20 minutes during the time when the system is being written to heavily - you should be able to see if it is being written to heavily by running sysstat 1 for a bit).
After a period of time you can run the following commands to see which client/ip is doing what:
nfsstat -l shows output like the following: tattoo> nfsstat -l tattoo> nfsstat -l 10.32.16.87 cousinit.hq.netapp.com NFSOPS = 172079 (94%) 10.32.16.88 pugsley.hq.netapp.com NFSOPS = 10580 ( 6%)
and nfsstat -h will show more detailed output for each client that is hitting the filer.
To turn the option off type: options nfs.per_client_stats.enable off
There is a small performance penalty for turning on per client stats.
Hope that helps. ~~~~~~~~~~~~~~~ Mike Smith Network Appliance Escalations Engineer 408-822-4755 mikesmit@netapp.com Get your answers on http://now.netapp.com ~~~~~~~~~~~~~~~~~
----- Original Message ----- From: Sims, Aaron Aaron.Sims@netapp.com To: BrianH@dice.com; toasters@mathworks.com Sent: Tuesday, January 09, 2001 7:39 PM Subject: RE: Net Stats, where from?
Use 'pktt' on the filer to collect a packet trace. It's in tcpdump format. You can use ethereal (www.ethereal.org) to read the trace. From that you should be able to find the culprit.
You can use pktt as such: (my comments are in {})
pktt start e0 { this starts tracing e0 } pktt dump { this causes a file to be created with the content of
the
dump} pktt stop e0 { stops capturing packets on e0 }
THe interface name can be changed to 'all'. There are some other options to pktt. -d <dir> /* Specifies the directory to put trace in */ -b <buffersize> /* How big a buffer to use to capture packets... don't make this too large... never more than 1m */ -i <ipaddr> /* Self explanitory */
There are some other options. You can search for 'pktt' on NOW to get more info.
Aaron
-----Original Message----- From: BrianH@dice.com [mailto:BrianH@dice.com] Sent: Tuesday, January 09, 2001 10:07 PM To: toasters@mathworks.com Subject: Net Stats, where from?
Does anyone know a nice easy way to tell where network traffic is coming from? Something like nfssat -l where you can see that x% of your traffic comes from xxx.xxx.xxx.xxx or something like that? I have tons and tons of writes happending on my 740, which is killing the CPU. The problem is it just started the other day and it is killing the overall performance of the filer. nfsstat -l shows me the number of NFS ops, and none of them seem out of line at all.
Ideas?
--Brian
-
Mike Smith -
Sims, Aaron