Tracing packets from all directions

Body

Ever wonder why z/OS Communications Server support asks for multiple traces for network issues? If so, here is the reason why.

The z/OS packet trace is collected from the perspective of the z/OS host that is sending or receiving data. The trace is collected before the data reaches the physical network, a.k.a the OSA NIC (network interface card). So in the case of outbound or sent packets trace records are collected before the data is processed by the VTAM DLC layer to be sent to the OSA NIC. Conversely, for inbound or received packets, they are traced after they arrive over the OSA NIC and before they are processed by the DLC layer in VTAM and TCP/IP.

Note that for the majority of network throughput issues ALL packet application data is not needed in the packet trace, so feel free to use the "abbrev=100 option" when you collect it!

The next possible choice for a z/OS "network" type trace is the OSAENTA trace. This trace captures packets from the OSA NIC perspective. This means that once packets sent from TCP/IP are sent over the OSA NIC, they are captured in the OSAENTA trace. Conversely, once packets arrive over the OSA NIC, before they reach VTAM and TCP/IP, they are collected in the OSAENTA trace. Hopefully, the picture is now more clear!

Note that the OSAENTA trace does not collect the entire packet application data contents. It is truncated to 200 bytes, so keep that in mind!
 

When diagnosing a network performance issue it is imperative to have the full network picture or as close to one as possible. Many peer hosts are often multiple router hops apart which add multiple points to look at.  Any delays captured with just a z/OS packet trace don't always tell the full story, so corresponding traces outside of z/OS are often requested. You may want to go ahead and collect an "external network" trace somewhere between the z/OS and remote host endpoints. This additional trace(s), when collected simultaneously with the z/OS packet trace, provides a greater insight as to where delays or packet loss may be occurring.
 

There are many workstation-based tools that are available for viewing network traces. The z/OS packet trace and OSAENTA traces are designed to be viewed with IPCS. I know not everyone is very comfortable or familiar with IPCS, so consider that there is a nice option called SNIFFER that can be used to format both of these traces into binary files that can be loaded into one of these other trace viewing products to make your life simpler without having to use IPCS to look at the traces.