PM61269: CONVERTING SYSTCPDA TO SNIFFER OR TCPDUMP LEADS TO INCORRECT LENGTH VALUES IN THE RESULTING CAP OR PCAP FILES

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• IPCS command ctrace comp(systcpda) with these options
  options((sniffer(1500))) or
     options((sniffer(1500 tcpdump)))
  is used to convert a SYSTCPDA packet trace to a format
  compatible with WireShark or TCPDUMP analysis tools,
  respectively.
  After conversion,  the number of 'bytes on wire' is higher than
  the 'bytes captured' even when the trace was not abbreviated
  during capture.
  Wireshark reports:
  [Packet size limited during capture: PRP truncated]
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of the IBM Communications Server   *
  *                 for z/OS Version 1 Release(s) 13: IP         *
  *                 Packet Trace Formatter                       *
  ****************************************************************
  * PROBLEM DESCRIPTION: Sniffer files created by the packet     *
  *                      trace formatter were reporting frame    *
  *                      lengths that were longer than the       *
  *                      actual frame length.                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The frame length and the capture data length were incorrectly
  calculated.
  +-------------------------------------------------------------+
  + Please check our Communications Server for OS/390 homepages +
  + for common networking tips and fixes.  The URL for these    +
  + homepages can be found in Informational APAR II11334.       +
  +-------------------------------------------------------------+
  

Problem conclusion

• EZBPTSNF has been amended to correctly calculate the frame
  length and captured length and place these values into the
  sniffer trace records.
  
  * Cross Reference between External and Internal Names
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK77768

Modules/Macros

• EZBPTSNF
  

Fix information

• Fixed component name

  TCP/IP V3 MVS

• Fixed component ID

  5655HAL00

Applicable component levels

• R1D0 PSY UK77768

     UP12/04/25 P F204

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.