FORMAT
Purpose
Format the CTRACE record header, the IP packet header, the protocol header, and the packet data. If one of the ports is a well-known port number and the SYSTCPDA supports data for the port number, the packet data is shown.
Format
CTRACE COMP(SYSTCPDA) SUB((TCPCS)) SHORT OPTIONS((FORMAT)) 1 3 MVSJ PACKET 00000001 23:39:11.873541 Packet Trace
2 To Interface : TR1 Device: LCS Token Ring Full=56
Tod Clock : 2002/02/12 23:39:11.873539
3 Sequence # : 0 Flags: Pkt Ver2 Out
Source Port : 1025 Dest Port: 53 Asid: 001E TCB: 007F62C0
4 IpHeader: Version : 4 Header Length: 20
Tos : 00 QOS: Routine Normal Service
Packet Length : 56 ID Number: 000E
Fragment : Offset: 0
5 TTL : 64 Protocol: UDP CheckSum: A6FB FFFF
Source : 9.67.113.65
Destination : 9.37.80.3
6 UDP
Source Port : 1025 () Destination Port: 53 (domain)
Datagram Length : 36 CheckSum: AD0B FFFF
7 DNS: 28
===============================================================================
8 ;; ->>DNS HEADER<<- opcode: QUERY, status: NOERROR, id: 40266
;; flags: rd; Ques: 1, Ans: 0, Auth: 0, Addit: 0
;; QUESTIONS: 1
;; w3.ibm.com IN AAAA- 1
- A summary line indicating the source of the trace record showing:
- The record number.
- The system name.
- The type of the trace record.
- The time the record was moved to the trace buffer, or with the TOD option the time the trace data was captured.
- The description of the trace record, Packet Trace, Data Trace, EE, or OSAENTA.
- 2
- The trace header with these fields:
- The direction of the trace record: From or To.
- The network interface name (or job name for Data Trace).
- The device type.
- Full or Abbrev with amount of trace data available.
- The time the trace record was captured.
- The number of records lost.
- 3
- The segment number of the CTRACE record for which this packet
trace record was written.
The flags that describe this trace record:
- CfTxt
- This packet contains confidential text.
- Adj
- The CTRACE record size was adjusted to a halfword length.
- Tunnel
- This packet consists of multiple protocol headers, for example, UDP that has an SNA packet (EE).
- Rsm
- This packet was reassembled from multiple packets.
- Home
- The source and destination of this packet are the same.
- IpExt
- The packet has IP header extensions.
- LS
- The packet was part of a segmentation offload group of packets.
- Ping
- The packet is ICMP or ICMPv6 echo or echo reply packet.
- Dat
- The packet was written in response to a DATTRACE command.
- AH
- The packet contains an authentication header.
- Seg
- This trace record was assembled from multiple CTRACE record segments.
- In
- This packet is an inbound packet.
- Out
- This packet is an outbound packet.
- Bad
- The packet had a validation error.
- CkSum
- The packet had a checksum error.
- Pdus
- This packet was written when multiple packets were in the same set of buffers.
- QID
- This packet contains a nonzero OSA QID.
- Nta
- This packet was written in response to an OSAENTA command.
- VLan
- This packet contains a VLAN identifier.
- Frame
- This packet contains an Ethernet header.
- LPAR
- This packet sent over an OSA as LPAR to LPAR.
- L2
- This packet was sent as a Level 2 packet (directly routed by using MAC addresses).
- L3
- This packet was sent as a Level 3 packet (indirectly routed by using IP addresses).
- Dscrd
- This packet was discarded by OSA or by TCPIP.
- Rsp
- This packet is a SNA RU response.
- Req
- This packet is a SNA RU request.
- FMD
- This packet is a SNA Function Management RU.
- NC
- This packet is a SNA Network Control RU.
- SC
- This packet is a SNA System Control RU.
- DFC
- This packet is a SNA Data Flow Control RU.
- FMH
- This packet contains a SNA Function Management header.
- SMC
- This packet was sent over an SMC-R interface.
- 4
- The IP header showing fields from the IPv4 header. The header length is the number of bytes for the header. The offset field is the number of bytes from the end of the IP header where the fragment appears. With the REASSEMBLY option active, this field always contains zeros.
- 5
- The check sum value. If possible, the check sum of the packet is calculated. If the calculated value is X'FFFF', the check sum is correct. If X'0000', the check sum could not be calculated because the packet was incomplete or fragmented. Other values indicate a check sum error.
- 6
- The UDP protocol header. The fields of the header are shown.
The port number for the PORT keywords define the port numbers to be used to invoke a format routine.
- Port
- Keyword
- 67, 68
- BOOTP
- 67, 68
- DHCP
- 53
- Domain
- 12000:12004
- EE
- 79
- Finger
- 70
- Gopher
- 80
- HTTP
- 500
- IKE
- 4500
- NAT
- 123
- NTP
- 111
- RPC
- 520
- RIP
- 520
- Router
- 25
- SMTP
- 161,162
- SNMP
- 23
- TELNET
- 69
- TFTP
- 37
- TIME
- 7
- The length of the DNS packet data following is shown.
- 8
- The DNS header and resource records are formatted. Using the protocol numbers and the known port numbers, format routines are invoked to format standard packet data records.
Figure 1. Format report example
1 17 MVSN PACKET 00000004 19:43:02.541728 Packet Trace
2 To Interface : LOGETH5 Device: QDIO Ethernet Full=6300
Tod Clock : 2004/10/18 19:43:02.541728 Intfx: 5
Sequence # : 0 Flags: Pkt Out Offl
3 IpHeader: Version : 4 Header Length: 20
Tos : 00 QOS: Routine Normal Service
Offload Length : 6300 ID Numbers: 0012-0016
Fragment : Offset: 0
4 TTL : 64 Protocol: TCP CheckSum: 0000 971D
Source : 8.1.1.1
Destination : 8.1.1.2
5 TCP
Source Port : 1026 () Destination Port: 1026 ()
Sequence Number : 3823117120 Ack Number: 3823533758
Header Length : 32 Flags: Ack Psh
Window Size : 32768 CheckSum: 120B 0000 Urgent Data Pointer: 0000
Offload Segments : 4 Length: 1448 Last: 456
Option : NOP
Option : NOP
Option : Timestamp Len: 10 Value: F3913448 Echo: F3913446 - 1
- A summary line indicating the source of the trace record showing:
- The record number.
- The system name.
- The type of the trace record.
- The time the record was moved to the trace buffer, or with the TOD option the time the trace data was captured.
- The description of the trace record, Packet Trace or Data Trace.
- 2
- The trace header with these fields:
- The direction of the trace record: From or To.
- The network interface name (or job name for Data Trace).
- The device type.
- Full or Abbrev with amount of trace data available.
- The time the trace record was captured.
- The number of records lost.
- The packet trace header flags.
- For inbound traffic, the queue identifier (QID) and queue type (for example, SYSDIST, BULKDATA, or EE) on which this packet was received using QDIO inbound workload queueing. For more information about QIDs, see QDIO inbound workload queueing in z/OS Communications Server: IP Configuration Guide.
- 3
- The IP header showing fields from the IPv4 header. The header length is the number of bytes for the header. The offset field is the number of bytes from the end of the IP header where the fragment appears. With the REASSEMBLY option active, this field always contains zeros. If segmentation is offloaded, the ID number field shows the range of IP identifiers represented by this send and the Offload Length field shows the total length of the send (total data length plus one set of headers).
- 4
- The check sum value. If possible, the check sum of the packet is calculated. If the calculated value is X'FFFF', the check sum is correct. If X'0000', the check sum could not be calculated because the packet was incomplete or fragmented. Other values indicate a check sum error.
- 5
- The TCP protocol header. The fields of the header are shown. If segmentation is offloaded, the Offload Segments field shows the number of TCP segments represented by this send and the length of each segment. The length of each segment is the data length (not including headers). If all the segments are the same size, then the Last field does not appear. If the remainder of data length is nonzero, then Last field contains the remainder.