> -----Original Message----- > From: Tayade, Nilesh > Sent: Monday, September 06, 2010 6:03 PM > To: linux-nfs@xxxxxxxxxxxxxxx > Subject: Query regarding NFS packet capture at application layer - > umount operation. > > Hi, > > I have a query related to NFS packet captured at application layer. > I have setup the NFS node on local system itself (just for test > purpose). > And capturing the packets for various events (mount, umount, file > access etc) on loop-back interface itself. However, in case of the > umount scenario, I do not see any NFS packet captured (I can only > see three TCP packets exchanged). > > Could someone please explain why there is no NFS packet observed > during an unmount? Also there seems not much information, related to > NFS mount point being unmounted, in TCP packet. So is there any way > to detect the unmount operation by hacking such packets? > > The last TCP packet looks like: > > Transmission Control Protocol, Src Port: 866 (866), Dst Port: 2049 > (2049), Seq: 1, Ack: 1, Len: 0 > Source port: 866 (866) > Destination port: 2049 (2049) > Sequence number: 1 (relative sequence number) > Acknowledgement number: 1 (relative ack number) > Header length: 32 bytes > Flags: 0x10 (ACK) > Checksum: 0xef2f [correct] > Options: (12 bytes) > This is an ACK to the segment in frame: 2 > The RTT to ACK the segment was: 0.000017000 seconds > > Please let me know in case the capture file is required. Attached is the capture file obtained using tshark, in case required. Also the NFS protocol version here is NFSv3. > -- > Thanks, > Nilesh > [nilesh(dot)tayade(at)netscout(dot)com]
Attachment:
nfs_unmount
Description: nfs_unmount
