Hi list
Attached is the latest version of the patch to snoop NFS filename->fhandle
mappings.
There are two new options:
The first option will allow ethereal to snoop all NFS v2/v3
LOOKUP/CREATE/MKDIR and MOUNT v1/v2/v3 MNT packets and build an internal
list of known name->fhandle mappings.
Everytime NFS/MOUNT/KLM/NLM/HCLNFSD prints a filehandle ethereal will now
add (nfs.name) "Filename: foo (snooped from packets x and y)"
The second option will make ethereal to print the full filename including
NFS server and path together with every fhandle.
(nfs.fullname) "Full Name: 123.4.5.6:/pub/foo/my_file.txt"
Ethereal processes the reply packets every time it scans through the
packet list, so it can handle that files change fhandles during
a capture.
(It always updates so it uses the last seen mapping.
((there are flaws with this, by clicking on a packet it might show
the wrong name))
(((there should be a mechanism which lets the dissector know the difference
between being called due to a rescan of the packet list
or if it is being called due to the user clicking on the packet)))
Ethereal does not check any other packets than above.
RENAME packets: These packets should not be used since
it is not possible to deduct the resulting fhandle for the
file after the rename.
(It might become stale (i.e. it changes))
Clients will probably always do LOOKUP on the new file anyway
before any attempts to access it is made. (which will let ethereal to
relearn the mapping)
REMOVE/RMDIR
These packets does not cause ethereal to forget the mapping and these
packets should not be used.
If two NFS clients have accessed the same file using say LOOKUP both clients
will use the same fhandle to refer to the same file.
If one of the clients REMOVE this file, the other client will still
try to use the (now) stale fhandle.
We want to be able to see fhandle->fname mappings also for stale fhandles.
It has been tested for NFSv2/v3. Some captures with 10.000+ packets.
The attached tgz file also contain a short description of the options which
might be good to put in the man-page and on Richard's users guide.
TODO:
1, Someone should add the code to do this also for NFSv4.
2, Using display filters will not match the entry "nfs.name" for the
fhandles which are called from outside packet-nfs.c.
I.e. "nfs.name==foo" will not find any packets in NLM etc.
Please comment or check in if acceptable.
best regards
ronnie sahlberg
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
Attachment:
nfs_snoop.tgz
Description: application/gzip-compressed
