Capturing PKTTRACE output for review

See II12136.TXT in this directory


Sample obeyfile members:
------------------------
DSN=SYS1.TCPPARMS(PKTTR@ON)
PKTTRACE ON LINKNAME=* IP=146.203.1.20 DESTPORT=25 SRCPORT=* PROT=* FULL

DSN=SYS1.TCPPARMS(PKTTR@ON)
PKTTRACE OFF LINKNAME=* IP=146.203.1.20

Sample writer proc:
-------------------
DSN=SYS1.PROCLIB(CTWRTR)
//CTWRTR  PROC DSN=SYS1.TCPIP.CTRACE
//IEFPROC EXEC PGM=ITTTRCWR,REGION=5M,TIME=1200
//TRCOUT01 DD  DISP=(NEW,CATLG),DSN=&DSN,
//             UNIT=SYSALLDA,SPACE=(CYL,(50),,CONTIG)
//SYSPRINT DD  SYSOUT=V

Sample Trace Formatter JCL:
---------------------------
//STEP001 EXEC PGM=IKJEFT01,REGION=6M,TIME=1200,DYNAMNBR=200
//STEPLIB  DD  DISP=SHR,DSN=SYS1.TCPIP.SEZALINK
//         DD  DISP=SHR,DSN=SYS1.TCPIP.SEZAMIG
//SYSTSPRT DD  SYSOUT=*
//SYSPRINT DD  SYSOUT=*
//IPCSDDIR DD  DISP=SHR,DSN=&SYSUID..DDIR
//IPCSTOC  DD  SYSOUT=*
//IPCSPRNT DD  SYSOUT=*
//DUMP     DD  DISP=SHR,DSN=&sysuid..ctrace.output
//SYSTSIN  DD  *
IPCS
  DROPDUMP DDNAME(DUMP)
  SETDEF DSNAME('&SYSUID..ctrace.output') NOCONFIRM
  CTRACE COMP(SYSTCPDA) FULL
END
/*
//


II12014
-------

Packet trace and Ctrace can be written to either an
external writer or to the TCPIP dataspace(TCPIPDS1)  - the
dataspace is the  default.

If Dataspace (INTERNAL) tracing is desired proceed to the
Dataspace SECTION 5.

If external writer is desired proceed to External writer


***** SECTION 1 ** STARTING WRITER STEP *****************

To have packet trace or Ctrace written to an
external writer dataset, a writer proc first needs to be
created. This proc either needs to be in SYS1.PROCLIB or
in a library concatenated in the MASTER JCL.
Sample Writer proc :

CTWTR1 PROC
//IEFPROC  EXEC PGM=ITTTRCWR
//TRCOUT01 DD DSNAME=IBMUSER.CTRACE1,VOL=SER=xxxxxx,
//         UNIT=xxxxx,SPACE=(CYL,(xxx),,CONTIG),
//         DISP=(NEW,CATLG)
//SYSPRINT DD SYSOUT=*

1.1) The following step starts the external writer to the
    CTRACE Component in order for it to be used for Tracing if
    you do not want to have the traces written internally to
    the TCPIP dataspace(TCPIPDS1). This starting of the writer
    can be used for multiple components, for instance packet
    trace(SYSTCPDA) and ctrace (SYSTCPIP).

    TRACE CT,WTRSTART=CTWTR1

    Once the writer has been successfully attached you can
    proceed with starting the trace(s) you need to run.
    If you want to run a CTRACE and PACKET trace using the
    same writer proceed to the Multiple Trace Step. If Packet
    alone is required proceed to Packet Trace Step. If Ctrace
    (SYSTCPIP) is required proceed to CTRACE STEP.


***** SECTION 2 ** PKTTRACE STEP (component SYSTCPDA) ***


2.0) The following step starts the external writer to the
    CTRACE Component in order for it to be used for Tracing if
    you do not want to have the traces written internally to
    the TCPIP dataspace(TCPIPDS1). This starting of the writer
    can be used for multiple components, for instance packet
    trace(SYSTCPDA) and ctrace (SYSTCPIP).

    TRACE CT,WTRSTART=CTWTR1

    Once the writer has been successfully attached you can
    proceed with starting the trace(s) you need to run.
    If you want to run a CTRACE and PACKET trace using the
    same writer proceed to the Multiple Trace Step. If Packet
    alone is required proceed to Packet Trace Step. If Ctrace
    (SYSTCPIP) is required proceed to CTRACE STEP.

2.1) This step starts Ctrace and gives it a component to use
    for tracing. The Required reply attaches the external
    writer that was previously started so it can be used to
    write the Packet trace records.

    TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)

       R xx,WTR=CTWTR1,END

2.2) Verify that Trace started successfully:

    D TRACE,COMP=SYSTCPDA,SUB=(tcpipprocname)

2.3) This step starts the packet trace processing in TCPIP.
    Without this step packets can not be captured by The
    ctrace component.

    V TCPIP,tcpipprocname,PKT,ON,IP=xx.xx.xx.xx

    or

    v TCPIP,tcpipprocname,OBEYFILE,dsname(member)

2.4) recreate problem .....

2.5) stopping Packet trace:

    V TCPIP,tcpipprocname,PKT,OFF

2.6) Disconnect the external writer:

    TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)

        R xx,WTR=DISCONNECT,END

2.7) stop external writer:

    TRACE CT,OFF,COMP=SYSTCPDA,SUB=(tcpipprocname)

    TRACE CT,WTRSTOP=CTWTR1,FLUSH


***** SECTION 3 ** CTRACE STEP (component SYSTCPIP) ****

3.1) This step starts Ctrace and gives it a component to use
    for tracing. The Required reply attaches the external
    writer that was previously started so it can be used to
    write the CTRACE records.

     TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)

        R xx,WTR=CTWTR1,OPTIONS=(XXXX,XXXX),END

    Note: For certain problems you should use jobname of the
    application when running ctrace(systcpip). Trace Options
    that should use jobname are (PFS,SOCKET,ENGINE,TCP)
    Valid Options are contained in Parmlib member CTIEZB00

3.2) Verify Trace was started successfully:

    D TRACE COMP=SYSTCPIP,SUB=(tcpiprocname)

3.3) Recreate problem........

3.4) Stop Ctrace comp(systcpip) and disconnect writer

    TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)

        R xx,WTR=DISCONNECT,END

3.5) Stop ctrace writer

    TRACE CT,OFF,COMP=SYSTCPIP,SUB=(tcpipprocname)
    TRACE CT,WTRSTOP=CTWTR1,FLUSH


***** SECTION 4 ** MULTIPLE TRACE STEP ******************

4.1) Start traces

    TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)
        R xx,WTR=CTWTR1,OPTIONS=(XXXX,XXXX),END
    TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)
        R xx,WTR=CTWTR1,END

    NOTE: You may use multiple writers (i.e. one for SYSTCPIP
    and one for SYSTCPDA)

4.2) Verify that Trace started successfully:

    D TRACE,COMP=SYSTCPDA,SUB=(tcpipprocname)
    D TRACE COMP=SYSTCPIP,SUB=(tcpiprocname)

4.3) This step starts the packet trace processing in TCPIP.
    Without this step packets can not be captured by The
    ctrace component.

    V TCPIP,tcpipprocname,PKT,ON,IP=xx.xx.xx.xx

4.4) Recreate failure............

4.5) Stop traces and writers:
    stopping Packet trace:

    V TCPIP,tcpipprocname,PKT,OFF

4.6) Disconnect the external writer:

    TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)

         R xx,WTR=DISCONNECT,END

4.7) stop external writer:

    TRACE CT,OFF,COMP=SYSTCPDA,SUB=(tcpipprocname)

4.8) Stop Ctrace comp(systcpip) and disconnect writer

    TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)

        R xx,WTR=DISCONNECT,END

4.9) Stop ctrace writer

    TRACE CT,OFF,COMP=SYSTCPIP,SUB=(tcpipprocname)
    TRACE CT,WTRSTOP=CTWTR1,FLUSH


***** SECTION 5 ** DATASPACE SECTION ********************

The first step to collecting traces to the dataspace is to
insure that the bufsize in CTIEZB00 in parmlib is set to
at least 8Mb. It may need to be set highter depending on
the amount of trace data desired, but 8mb should be a good
starting point!  TCPIP will need to be restarted for the
change in bufsize to take affect.
The starting writer step can be skipped as it will not be
needed when writing to the Dataspace. The trace data will
be captured via an MVS Dump Comm command that will dump
the TCPIP Dataspace named TCPIPDS1. Be aware that this
method may result in lost trace data as the possiblity of
wrapping is very possible. The dump command should be
issued very soon after the problem happens or the dumps
should be collected via a trap or slip issued given by the
support center.

5.1) Starting Ctrace comp(SYSTCPIP):

    TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)

           R XX,OPTIONS=(XXX,XXX),END

5.2) recreate problem.....

5.3) Stop Ctrace comp(SYSTCPIP):

    TRACE CT,OFF,COMP=SYSTCPIP,SUB=(tcpipprocname)

5.4) Starting packet trace comp(SYSTCPDA):

    TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)

5.5) This step starts the packet trace processing in TCPIP.
    Without this step packets can not be captured by The
    ctrace component.

    V TCPIP,tcpipprocname,PKT,ON,IP=xx.xx.xx.xx

5.6) recreate problem...............

5.7) Stop Packet trace comp(SYSTCPDA):

    V TCPIP,tcpipprocname,PKT,OFF,IP=xx.xx.xx.xx

    TRACE CT,OFF,COMP=SYSTCPDA,SUB=(tcpipprocname)

5.8) Collect Dump of TCPIP Dataspace and TCPIP address space:
    Issue the following MVS command from the system console:

    DUMP COMM=('text')

     R xx,JOBNAME=(tcpipprocname),DSPNAME=('tcpipprocname'.*),
     SDATA=(ALLNUC,CSA,LPA,LSQA,RGN,SWA,SQA,TRT),END


****** SECTION 6 ** PKTTRACE PARMS **********************

There are 2 ways add parms to the SYSTCPDA CTRACE
(PKTTRACE). The 1st way will AND the parms together and
the 2nd way will OR the parms together:

1) V TCPIP,tcpipproc,PKT,SRCP=21,DEST=1236

  In this example only packets with source port=21 *and*
  destination port=1236

2) V TCPIP,tcpipproc,PKT,SRCP=21
  V TCPIP,tcpipproc,PKT,DEST=1236
  Note! 2 VARY commands

  In this example packets with a source port=21,
  regardless of dest port, *and* packets with dest
  port=1236, regardless of source port.