How to run a packet trace from Unix / Linux (4281677)

How to run a packet trace from Unix / Linux

1. Run the following command to find out the network interface to capture on

# ip addr

1. Open two terminals
2. In terminal 1 run as root

# tcpdump -I <network interface> -s 0 -w /tmp/packet.pcap

1. In terminal 2 run as root the command that causes or triggers the failure

eg: # /opt/quest/bin/vastool -u host/ -d5 auth host/ 2>&1 | tee /tmp/auth.out

1. Once the command completes in terminal 2 then stop the packet trace in terminal 1 with Ctrl C

Two output files were generated for analysis. (/tmp/packet.pcap & /tmp/auth.out)

Note:

On some Unix systems 'snoop' may be used instead of 'tcpdump'.

# snoop -d <network interface> -o /tmp/packet.pcap