Query regarding NFS packet capture at application layer - umount operation.

Query regarding NFS packet capture at application layer - umount operation.

[Tayade, Nilesh]

Hi,

I have a query related to NFS packet captured at application layer. I
have setup the NFS node on local system itself (just for test purpose). 
And capturing the packets for various events (mount, umount, file access
etc) on loop-back interface itself. However, in case of the umount
scenario, I do not see any NFS packet captured (I can only see three TCP
packets exchanged). 

Could someone please explain why there is no NFS packet observed during
an unmount? Also there seems not much information, related to NFS mount
point being unmounted, in TCP packet. So is there any way to detect the
unmount operation by hacking such packets?

The last TCP packet looks like:

Transmission Control Protocol, Src Port: 866 (866), Dst Port: 2049
(2049), Seq: 1, Ack: 1, Len: 0
Source port: 866 (866)
Destination port: 2049 (2049)
Sequence number: 1    (relative sequence number)
Acknowledgement number: 1    (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
Checksum: 0xef2f [correct]
Options: (12 bytes)
This is an ACK to the segment in frame: 2
The RTT to ACK the segment was: 0.000017000 seconds

Please let me know in case the capture file is required.

--
Thanks,
Nilesh
[nilesh(dot)tayade(at)netscout(dot)com]

Re: Query regarding NFS packet capture at application layer - umount operation.

[Bian Naimeng]

> Hi,
> 
> I have a query related to NFS packet captured at application layer. I
> have setup the NFS node on local system itself (just for test purpose). 
> And capturing the packets for various events (mount, umount, file access
> etc) on loop-back interface itself. However, in case of the umount
> scenario, I do not see any NFS packet captured (I can only see three TCP
> packets exchanged). 
> 
> Could someone please explain why there is no NFS packet observed during
> an unmount? Also there seems not much information, related to NFS mount
> point being unmounted, in TCP packet. So is there any way to detect the
> unmount operation by hacking such packets?
> 

  I guess you used NFSv4. NFSv4 umount operation does not send any NFS packet.
  The TCP packets you captured were sent by TCP close procedure, because NFS
  umount operation need close the TCP connection with NFS server.

-- 
Regards
Bian Naimeng

RE: Query regarding NFS packet capture at application layer - umount operation.

[Tayade, Nilesh]

> -----Original Message-----
> From: Bian Naimeng [mailto:biannm@cn.fujitsu.com]
> Sent: Tuesday, September 07, 2010 1:18 PM
> To: Tayade, Nilesh
> Cc: linux-nfs@vger.kernel.org
> Subject: Re: Query regarding NFS packet capture at application layer
> - umount operation.
> 


> > Could someone please explain why there is no NFS packet observed
> during
> > an unmount? Also there seems not much information, related to NFS
> mount
> > point being unmounted, in TCP packet. So is there any way to
> detect the
> > unmount operation by hacking such packets?
> >
> 
>   I guess you used NFSv4. NFSv4 umount operation does not send any
> NFS packet.
>   The TCP packets you captured were sent by TCP close procedure,
> because NFS
>   umount operation need close the TCP connection with NFS server.

I am using NFSv3. (Sorry, I forgot to mention it in first email - so I
have replied to my original email with capture file).

> 
> --
> Regards
> Bian Naimeng

Re: Query regarding NFS packet capture at application layer - umount operation.

[Jeff Layton]

On Tue, 7 Sep 2010 04:02:29 -0400
"Tayade, Nilesh" <Nilesh.Tayade@netscout.com> wrote:

> > -----Original Message-----
> > From: Bian Naimeng [mailto:biannm@cn.fujitsu.com]
> > Sent: Tuesday, September 07, 2010 1:18 PM
> > To: Tayade, Nilesh
> > Cc: linux-nfs@vger.kernel.org
> > Subject: Re: Query regarding NFS packet capture at application layer
> > - umount operation.
> > 
> 
> 
> > > Could someone please explain why there is no NFS packet observed
> > during
> > > an unmount? Also there seems not much information, related to NFS
> > mount
> > > point being unmounted, in TCP packet. So is there any way to
> > detect the
> > > unmount operation by hacking such packets?
> > >
> > 
> >   I guess you used NFSv4. NFSv4 umount operation does not send any
> > NFS packet.
> >   The TCP packets you captured were sent by TCP close procedure,
> > because NFS
> >   umount operation need close the TCP connection with NFS server.
> 
> I am using NFSv3. (Sorry, I forgot to mention it in first email - so I
> have replied to my original email with capture file).
> 

I'm fairly sure that's still handled by the userspace piece. Do you
have a /sbin/umount.nfs? If not, that may be why.

-- 
Jeff Layton <jlayton@redhat.com>

Re: Query regarding NFS packet capture at application layer - umount operation.

[J. Bruce Fields]

On Tue, Sep 07, 2010 at 01:19:02PM -0400, Jeff Layton wrote:
> On Tue, 7 Sep 2010 04:02:29 -0400
> "Tayade, Nilesh" <Nilesh.Tayade@netscout.com> wrote:
> 
> > > -----Original Message-----
> > > From: Bian Naimeng [mailto:biannm@cn.fujitsu.com]
> > > Sent: Tuesday, September 07, 2010 1:18 PM
> > > To: Tayade, Nilesh
> > > Cc: linux-nfs@vger.kernel.org
> > > Subject: Re: Query regarding NFS packet capture at application layer
> > > - umount operation.
> > > 
> > 
> > 
> > > > Could someone please explain why there is no NFS packet observed
> > > during
> > > > an unmount? Also there seems not much information, related to NFS
> > > mount
> > > > point being unmounted, in TCP packet. So is there any way to
> > > detect the
> > > > unmount operation by hacking such packets?
> > > >
> > > 
> > >   I guess you used NFSv4. NFSv4 umount operation does not send any
> > > NFS packet.
> > >   The TCP packets you captured were sent by TCP close procedure,
> > > because NFS
> > >   umount operation need close the TCP connection with NFS server.
> > 
> > I am using NFSv3. (Sorry, I forgot to mention it in first email - so I
> > have replied to my original email with capture file).
> > 
> 
> I'm fairly sure that's still handled by the userspace piece. Do you
> have a /sbin/umount.nfs? If not, that may be why.

Or if you're only capturing traffic to port 2049, that would also
explain why you don't see anything.  (NFSv2/v3 mount/umount use
different protocol.)

--b.

RE: Query regarding NFS packet capture at application layer - umount operation.

[Tayade, Nilesh]

> -----Original Message-----
> From: J. Bruce Fields [mailto:bfields@fieldses.org]
> Sent: Tuesday, September 07, 2010 11:01 PM
> To: Jeff Layton
> Cc: Tayade, Nilesh; Bian Naimeng; linux-nfs@vger.kernel.org
> Subject: Re: Query regarding NFS packet capture at application layer
> - umount operation.
> 


> > > I am using NFSv3. (Sorry, I forgot to mention it in first email
> - so I
> > > have replied to my original email with capture file).
> > >
> >
> > I'm fairly sure that's still handled by the userspace piece. Do
> you
> > have a /sbin/umount.nfs? If not, that may be why.
> 
> Or if you're only capturing traffic to port 2049, that would also
> explain why you don't see anything.  (NFSv2/v3 mount/umount use
> different protocol.)
> 
> --b.

Thanks for the pointers. That appears to be the case. I could see the
header of MOUNT in the packet when I mounted/umounted the node. I
thought there will be the NFS header instead.

--
Thanks,
Nilesh

RE: Query regarding NFS packet capture at application layer - umount operation.

[Tayade, Nilesh]

[-- Attachment #1: Type: text/plain, Size: 1678 bytes --]

> -----Original Message-----
> From: Tayade, Nilesh
> Sent: Monday, September 06, 2010 6:03 PM
> To: linux-nfs@vger.kernel.org
> Subject: Query regarding NFS packet capture at application layer -
> umount operation.
> 
> Hi,
> 
> I have a query related to NFS packet captured at application layer.
> I have setup the NFS node on local system itself (just for test
> purpose).
> And capturing the packets for various events (mount, umount, file
> access etc) on loop-back interface itself. However, in case of the
> umount scenario, I do not see any NFS packet captured (I can only
> see three TCP packets exchanged).
> 
> Could someone please explain why there is no NFS packet observed
> during an unmount? Also there seems not much information, related to
> NFS mount point being unmounted, in TCP packet. So is there any way
> to detect the unmount operation by hacking such packets?
> 
> The last TCP packet looks like:
> 
> Transmission Control Protocol, Src Port: 866 (866), Dst Port: 2049
> (2049), Seq: 1, Ack: 1, Len: 0
> Source port: 866 (866)
> Destination port: 2049 (2049)
> Sequence number: 1    (relative sequence number)
> Acknowledgement number: 1    (relative ack number)
> Header length: 32 bytes
> Flags: 0x10 (ACK)
> Checksum: 0xef2f [correct]
> Options: (12 bytes)
> This is an ACK to the segment in frame: 2
> The RTT to ACK the segment was: 0.000017000 seconds
> 
> Please let me know in case the capture file is required.

Attached is the capture file obtained using tshark, in case required.
Also the NFS protocol version here is NFSv3.

> --
> Thanks,
> Nilesh
> [nilesh(dot)tayade(at)netscout(dot)com]


[-- Attachment #2: nfs_unmount --]
[-- Type: application/octet-stream, Size: 270 bytes --]