Technical data

Troubleshooting Techniques and Tools

1.2 Isolating Problems

• The seventh line indicates that host csam has received data sent by host rtsg

up to but not including byte 21. Most of this data is apparently sitting in the

socket buffer because the receive window on host csam is 19 bytes smaller.

Host csam also sends one byte of data to host rtsg in this packet.

• The eighth and ninth lines show that host csam sends two bytes of urgent,

pushed data to rtsg.

1.2.5.3.4 UDP Packets The UDP format is illustrated by the following RWHO

packet:

actinide.who > broadcast.who: udp 84

This line of output indicates that port who on host actinide sent a UDP datagram

to port who on host broadcast, the Internet broadcast address. The packet

contained 84 bytes of user data.

Some UDP services are recognized (from the source or destination port number)

and the higher level protocol information displayed, speciﬁcally Domain Name

service requests (RFC 1034 and RFC 1035) and Sun RPC calls (RFC 1050) to

NFS.

1.2.5.3.5 UDP Name Server Requests The following description assumes

familiarity with the Domain Service protocol described in RFC 1035.

Name server requests are formatted as follows:

src > dst: id op? flags qtype qclass name (len)

For example:

h2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)

Host h2opolo queried the domain server on host helios for an address record

(qtype=A) associated with the name ucbvax.berkeley.edu. The query ID was

3. The plus sign (+) indicates the recursion desired ﬂag was set. The query

length was 37 bytes, not including the UDP and IP protocol headers. The query

operation was the normal one, Query, so the op ﬁeld was omitted. If the op ﬁeld

had been anything else, it would have been displayed between the 3 and the plus

sign (+). Similarly, the qclass was the normal one, C_IN, and omitted. Any other

qclass would have been displayed immediately after the A.

The following anomalies are checked and may result in extra ﬁelds enclosed in

square brackets:

• If a query contains an answer, name server, or authority section, ancount,

nscount, or arcount are displayed as [na], [nn] or [nau], where n is the

appropriate count.

• If any of the response bits are set (AA, RA or rcode) or any of the ‘‘must be

zero’’ bits are set in bytes 2 and 3, [b2&3=x]) is displayed, where x is the

hexadecimal value of header bytes 2 and 3.

1.2.5.3.6 UDP Name Server Responses Name server responses are formatted

as follows:

src > dst: id op rcode flags a|n|au type class data (len)

For example:

helios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)

helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)

1–18 Troubleshooting Techniques and Tools