NFS Tracing by Passive Network Monitoring

Abstract:

Traces of filesystem activity have proven to be useful for a wide
variety of purposes, ranging from quantitative analysis of system
behavior to trace-driven simulation of filesystem algorithms. Such
traces can be difficult to obtain, however, usually entailing
modification of the filesystems to be monitored and runtime overhead
for the period of the trace. Largely because of these difficulties, a
surprisingly small number of filesystem traces have been conducted, and
few sample workloads are available to filesystem researchers. This
paper describes a portable toolkit for deriving approximate traces of
NFS [1] activity by non-intrusively monitoring the Ethernet traffic to
and from the file server. The toolkit uses a promiscuous Ethernet
listener interface (such as the Packetfilter[2]) to read and
reconstruct NFS-related RPC packets intended for the server. It
produces traces of the NFS activity as well as a plausible set of
corresponding client system calls. The tool is currently in use at
Princeton and other sites, and is available via anonymous ftp. [This
was true in 1991-1992, but is no longer true.]