how to parse the 64byte NFSv3 file handle
Subsystems (2)
hi,all
recently, I want to get some information (like file access patten) from a trace of NFS client. The simplest way may be parse the file handle to get the file ino and directory ino, but I don't know how to get them from the 64 of 16 hexadecimal. Can you tell me how to parse file handle to get useful information, thanks very much.
best regards=A3=A1
Jing
PS, there is some file handles from the trace
bcdaa400ce7a23012000000000a4dabcce7a230164860000a0cf90002e303000 b7905500246c6a1220000000000cec5413b72e3264860000a0cf90002e303000 bcdaa400ce7a23012000000000a4dabcce7a230164860000a0cf90002e303000 bcdaa400ce7a230120000000004ad8e8f8b2230164860000a0cf90002e303000 bcdaa400ce7a230120000000004ad8e8f8b2230164860000a0cf90002e303000 bcdaa400ce7a230120000000001074cd975e480564860000a0cf90002e303000
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 12 lines · xing jing
hi,all
recently, I want to get some information (like file access patten) from a trace of NFS client. The simplest way may be parse the file handle to get the file ino and directory ino, but I don't know how to get them from the 64 of 16 hexadecimal. Can you tell me how to parse file handle to get useful information, thanks very much. =20
best regards=A3=A1
=20
Jing
=20
=20
Quoted 8 lines
PS, there is some file handles from the trace
=20bcdaa400ce7a23012000000000a4dabcce7a230164860000a0cf90002e303000b7905500246c6a1220000000000cec5413b72e3264860000a0cf90002e303000bcdaa400ce7a23012000000000a4dabcce7a230164860000a0cf90002e303000bcdaa400ce7a230120000000004ad8e8f8b2230164860000a0cf90002e303000bcdaa400ce7a230120000000004ad8e8f8b2230164860000a0cf90002e303000bcdaa400ce7a230120000000001074cd975e480564860000a0cf90002e303000
What server generated them?
This doesn't look like the linux nfsd format (as defined in include/linux/nfsd/nfsfh.h)
That file handle contents are opaque to the client so you'd need to have the server's code or reverse engineer its structure.
Try running ls -li on a file and parent directory and see if you can identify the respective inode numbers in the filehandle. (likely to be coded in big-endian)
Benny
Quoted 2 lines
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" =
in
Quoted 2 lines
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 10 lines · Benny Halevy
Quoted 5 lines · xing jing
recently, I want to get some information (like file access patten) from a trace of NFS client. The simplest way may be parse the file handle to get the file ino and directory ino, but I don't know how to get them from the 64 of 16 hexadecimal. Can you tell me how to parse file handle to get useful information, thanks very much.
That file handle contents are opaque to the client so you'd need to have the server's code or reverse engineer its structure.
Wireshark understands the format of many NFS server filehandles. You can simply zoom-in on the filehandle in the details pane to see much of this. Alternatively, you can look back in the trace to find the LOOKUP or READDIR/READDIRPLUS to find the mapping between name and filehandle.
By the way, not all filehandles are 64 bytes. That, too, is a server-specific choice.
Tom.
A message that is not in the archive (sent off-list or not yet received): RTPCLUEXC1-PRDpAOAk000000fd-rtwIt2gI0FxT+ZUat5FNkAK/[email protected]
Quoted 12 lines · Thomas
Quoted 10 lines · Benny Halevy
Quoted 5 lines · xing jing
recently, I want to get some information (like file access patten) from a trace of NFS client. The simplest way may be parse the file handle to get the file ino and directory ino, but I don't know how to get them from the 64 of 16 hexadecimal. Can you tell me how to parse file handle to get useful information, thanks very much.
That file handle contents are opaque to the client so you'd need to have the server's code or reverse engineer its structure.
Quoted 8 lines
Wireshark understands the format of many NFS server filehandles. You can simply zoom-in on the filehandle in the details pane to see much of this. Alternatively, you can look back in the trace to find the LOOKUP or READDIR/READDIRPLUS to find the mapping between name and filehandle.
By the way, not all filehandles are 64 bytes. That, too, is a server-specific choice.
...and in Linux it is actually a filesystem-specific choice.
Furthermore, since not all Linux filesystems have permanently stored inode numbers, many filehandle types don't encode an inode number.
Finally, if you turn off subtree checking (as indeed you should), then the filehandle doesn't contain a directory inode number.
In other words, parsing filehandles to obtain inode numbers from Linux servers is not a task that can be easily automated...
Trond
Quoted 12 lines · Thomas
Quoted 10 lines · Benny Halevy
Quoted 5 lines · xing jing
recently, I want to get some information (like file access patten) from a trace of NFS client. The simplest way may be parse the file handle to get the file ino and directory ino, but I don't know how to get them from the 64 of 16 hexadecimal. Can you tell me how to parse file handle to get useful information, thanks very much.
That file handle contents are opaque to the client so you'd need to have the server's code or reverse engineer its structure.
Quoted 7 lines
Wireshark understands the format of many NFS server filehandles. You can simply zoom-in on the filehandle in the details pane to see much of this. Alternatively, you can look back in the trace to find the LOOKUP or READDIR/READDIRPLUS to find the mapping between name and filehandle.
By the way, not all filehandles are 64 bytes. That, too, is a server-specific choice.
Wireshark has the ability to sniff filehandles from certain server types. I believe both Linux server file handles and NetApp file handles are supported. You need to set this in the preference pane for the NFS decoder, it won't try to discover which server type you use automatically. Otherwise it will treat file handles as entirely opaque.
Also, there is a checkbox in the NFS decoder preference pane for enabling wireshark to associated file handles with file names and display the file names where appropriate. The checkbox is "Snoop FH to filename mappings".
Quoted 8 lines
Tom.
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com
Quoted 4 lines · Chuck Lever
Also, there is a checkbox in the NFS decoder preference pane for enabling wireshark to associated file handles with file names and display the file names where appropriate.
The checkbox is "Snoop FH to filename mappings".
Ooh- didn't know about that one. Cool. It can even build the entire directory <-> FH tree to show the full pathname, if available.
http://wiki.wireshark.org/NFS_Preferences
Tom.