TCP/IP Stack Packet Trace with TRSOURCE

This method of capturing packet data employs native CP tracing facilities. Data is captured and stored in a file for formatting and viewing by the IPFORMAT tool. The collection of data in this manner, and its analysis using IPFORMAT may prove to be an effective method of troubleshooting a variety of TCP/IP problems, especially for those familiar with network diagnostic tools on other platforms that provide formatted packet data for analytical use.

To collect a TCP/IP stack packet trace in concert with TRSOURCE tracing functions, use the steps that follow.
Note: A sample program (PKTTRACE SAMPEXEC) is provided with TCP/IP for z/VM® that illustrates how the steps outlined below can be encapsulated to simplify the process of obtaining and processing a TRSOURCE-based packet trace. For more information, refer to the commentary and program instructions provided within the PKTTRACE SAMPEXEC file.
  1. Issue the following commands to enable the trace: 
    NETSTAT OBEY PACKETTRACESIZE 64 
NETSTAT OBEY TRACEONLY ETH0 ENDTRACEONLY
    • PACKETTRACESIZE 64 specifies that 64 bytes of inbound and outbound data will be collected for each packet
    • TRACEONLY ETH0 ENDTRACEONLY specifies that packet trace data should be collected for device ETH0 (where ETH0 corresponds to the device_name on a DEVICE statement in the TCP/IP server configuration file)
  2. Issue the following Control Program commands to start data collection: 
    TRSOURCE ID TCP TYPE GT BLOCK FOR USER tcpip_userid 
TRSOURCE ENABLE ID TCP
    • The first TRSOURCE command defines the trace desired (where tcpip_userid is the user ID of the relevant TCP/IP server)
    • The second TRSOURCE command enables the trace
  3. Recreate the problem to be traced
  4. To stop tracing issue the following commands: 
    NETSTAT OBEY PACKETTRACESIZE 0 
NETSTAT OBEY TRACEONLY ENDTRACEONLY 
TRSOURCE DISABLE ID TCP
    • The two NETSTAT commands disable the TCP/IP server packet trace
    • The TRSOURCE command disables the CP trace defined earlier
  5. Use the following command to determine the spool file identifier for the TRF file: 
    QUERY TRFILES USERID tcpip_userid
  6. Use the following TRACERED command to format the trace data: 
    TRACERED nnnnn CMS TCP TRACE A ( ALL

    where nnnnn is the spool file identifier returned from the previous QUERY command

  7. Use IPFORMAT to view the formatted trace file (see Using IPFORMAT Packet Trace Formatting Tool).