HP-UX Reference (11i v2 03/08) - 1M System Administration Commands N-Z (vol 4)

n
netfmt(1M) netfmt(1M)
subsystems except those excluded by the list of negated subsystems. To include all
subsystems (the default), use the * operator. To eliminate all subsystems, use the
!* operator.
kl_formatter filter time_from value
kl_formatter filter time_through value
The functionality is same as in the case of
NetTL.
Subsystem Filtering
Note: Global filtering described above takes precedence over individual subsystem tracing and logging
filtering described below.
Subsystem filters are provided to allow filtering of data for individual subsystems or groups of subsys-
tems. Their behavior varies among individual subsystems. Subsystem filters are valid only when the
corresponding subsystems have been installed and configured on the system. See the subsystem docu-
mentation for a description of supported subsystem filters and their behavior.
Subsystem filtering commands start with the name of the subsystem followed by the subsystem filter key-
words. However, to provide convenience and backwards compatibility, several other filter keywords are
provided for the group of LAN subsystems:
NAME
and FILTER. Currently, four types of subsystem
filters are provided:
LAN, X25, STREAMS, and
OTS. The collection of LAN subsystems use the subsystem
filters identified by the
FILTER and NAME keywords and the collection of OTS
subsystems use the sub-
system filters with the
OTS keyword. The collection of X25 subsystems start their filter commands with
the X25 subsystem names.
LAN Naming and Filtering
LAN naming can be used to symbolically represent numbers with more recognizable labels.
name nodename value
nodename is a character string to be displayed in place of all occurrences of value. value is a
(IEEE802.3/Ethernet) hardware address consisting of 6 bytes specified in hexadecimal
(without leading "0x"), optionally separated by
-. netfmt substitutes all occurrences of
value with nodename in the formatted output. The mapping is disabled when the -n option is
used. This option applies to tracing output only.
LAN filtering is used to selectively format packets from the input file. There are numerous filter types,
each associated with a particular protocol layer:
Filter Layer Filter Type Description
Layer 1 dest hardware destination address
source hardware source address
interface software network interface
Layer 2 ssap IEEE802.2 source sap
dsap IEEE802.2 destination sap
type Ethernet type
Layer 3 ip_saddr IP source address
ip_daddr IP destination address
ip_proto IP protocol number
ip6_saddr IPv6 source address
ip6_daddr IPv6 destination address
ip6_proto IPv6 protocol number
Layer 4 tcp_sport TCP source port
tcp_dport TCP destination port
udp_sport UDP source port
udp_dport UDP destination port
connection a level 4 (TCP, UDP) connection
connection6 a level 4 (TCP, UDP) connection for IPv6
Layer 5 rpcprogram RPC program
rpcprocedure RPC procedure
rpcdirection RPC call or reply
Filtering occurs at each of the five layers. If a packet matches any filter within a layer, it is passed up to
the next layer. The packet must pass every layer to pass through the entire filter. Filtering starts with
Layer 1 and ends with Layer 5. If no filter is specified for a particular layer, that layer is ‘‘open’’ and all
packets pass through. For a packet to make it through a filter layer which has a filter specified, it must
HP-UX 11i Version 2: August 2003 − 6 − Hewlett-Packard Company Section 1M−−509