netfmt.1m (2011 03)

n
netfmt(1M) netfmt(1M)
Subsystem Filtering
Note : Global filtering described above takes precedence over individual subsystem tracing and logging
filtering described below.
Subsystem filters are provided to allow filtering of data for individual subsystems or groups of subsys-
tems. Their behavior varies among individual subsystems. Subsystem filters are valid only when the
corresponding subsystems have been installed and configured on the system. See the subsystem docu-
mentation for a description of supported subsystem filters and their behavior.
Subsystem filtering commands start with the name of the subsystem followed by the subsystem filter key-
words. However, to provide convenience and backwards compatibility, several other filter keywords are
provided for the group of LAN subsystems:
NAME and FILTER. Currently, four types of subsystem
filters are provided: LAN, X25, STREAMS, and OTS. The collection of LAN subsystems use the subsys-
tem filters identified by the
FILTER and NAME keywords and the collection of OTS subsystems use the
subsystem filters with the
OTS keyword. The collection of X25 subsystems start their filter commands
with the X25 subsystem names.
LAN Naming and Filtering
LAN naming can be used to symbolically represent numbers with more recognizable labels.
name nodename value
nodename is a character string to be displayed in place of all occurrences of value . value is a
(IEEE802.3/Ethernet) hardware address consisting of 6 bytes specified in hexadecimal
(without leading "0x"), optionally separated by
-. netfmt substitutes all occurrences of value
with nodename in the formatted output. The mapping is disabled when the
-n option is used.
This option applies to tracing output only.
LAN filtering is used to selectively format packets from the input file. There are numerous filter types,
each associated with a particular protocol layer:
Filter Layer Filter Type Description
Layer 1 dest hardware destination address
source hardware source address
Layer 2 ssap IEEE802.2 source sap
dsap IEEE802.2 destination sap
type Ethernet type
Layer 3 ip_saddr IP source address
ip_daddr IP destination address
ip_proto IP protocol number
ip6_saddr IPv6 source address
ip6_daddr IPv6 destination address
ip6_proto IPv6 protocol number
Layer 4 tcp_sport TCP source port
tcp_dport TCP destination port
udp_sport UDP source port
udp_dport UDP destination port
connection a level 4 (TCP, UDP) connection
connection6 a level 4 (TCP, UDP) connection for IPv6
Layer 5 rpcprogram RPC program
rpcprocedure RPC procedure
rpcdirection RPC call or reply
Filtering occurs at each of the five layers. If a packet matches any filter within a layer, it is passed up to
the next layer. The packet must pass every layer to pass through the entire filter. Filtering starts with
Layer 1 and ends with Layer 5. If no filter is specified for a particular layer, that layer is "open" and all
packets pass through. For a packet to make it through a filter layer which has a filter specified, it must
match the filter. Filters at each layer are logically O’ed. Filters between layers are logically ANDed.
LAN trace and log filters use the following format:
filter type [!] value  *
filter is the keyword identifying the filter as a LAN subsystem filter.
The following filters are available for LAN tracing.
filter connection value
value takes the form:
HP-UX 11i Version 3: March 2011 − 5 − Hewlett-Packard Company 5