HP OpenVMS systems documentation

If you suspect one of the interfaces is down, you can test the interface by using:

• The ping command on another system to ping the IP address of the suspect interface. Because TCP/IP Services sends messages via the first matching entry in the routing table, you might not be exercising the interface if you test on the local system.
• The traceroute -s src_addr command on the local system. This command uses the IP address specified with the -s flag in outgoing probe packets. If the command fails, the error message may indicate that the problem is with the interface.

Use the ifconfig command to check the configuration of a network interface. A common problem is a misconfigured subnet mask or incorrect IP address. Be sure to check the values of these parameters.

To display configuration information for all interfaces, enter the following command:

TCPIP> ifconfig -a LO0: flags=100c89<UP,LOOPBACK,NOARP,MULTICAST,SIMPLEX,NOCHECKSUM> inet6 ::1 TN0: flags=80<NOARP> WF0: flags=c43<UP,BROADCAST,RUNNING,MULTICAST,SIMPLEX> *inet 10.10.2.1 netmask ffffff00 broadcast 10.10.2.255 ipmtu 1500 inet6 fe80::200:f8ff:febd:bc22 inet6 3ffe:1200:4120:1000:200:f8ff:febd:bc22

For example, to display the configuration for interface WF0, enter the following command:

TCPIP> ifconfig WF0

The system displays the following information:

WF0: flags=c43<UP,BROADCAST,RUNNING,MULTICAST,SIMPLEX> inet 127.0.0.1 netmask ffff0000 broadcast 10.10.2.255 ipmtu 4470 inet6 fe80::200:f8ff:febd:bc22 inet6 3ffe:1200:4120:1000:200:f8ff:febd:bc22

The first line of this display shows the interface characteristics. The interface should be UP and RUNNING (exceptions to this are the LO0 and TN0 interfaces). The pertinent fields in this display show the interface's IP address, the subnet mask, the broadcast mask, and the maximum transmit unit.

You can also obtain information using the following commands:

TCPIP> SHOW INTERFACE Packets Interface IP_Addr Network mask Receive Send MTU LO0 127.0.0.1 255.0.0.0 137 137 4096 WE0 10.10.2.1 255.255.255.0 5089 4191 1500 TCPIP> SHOW CONFIGURATION INTERFACE Interface: LO0 IP_Addr: 127.0.0.1 NETWRK: 255.0.0.0 BRDCST: Interface: WE0 IP_Addr: 10.10.2.1 NETWRK: 255.255.255.0 BRDCST: 10.10.2.255

If you are not familiar with IP addressing and the concepts of subnet and broadcast masks, review the information in HP TCP/IP Services for OpenVMS Management before proceeding with troubleshooting tasks.

1.2.3 Displaying and Modifying the Internet-to-Ethernet Translation Tables

Use the arp utility or the SHOW ARP management command to check the IP address to Ethernet address translation entries in the Address Resolution Protocol (ARP) table. This is useful if you think incorrect entries are being added to the ARP table. For example, if you enter a command and an unexpected host responds, you may have two systems defined with the same IP address in the ARP table.

To display entries in the ARP table, enter the following command:

$ TCPIP SHOW ARP Cnt Flags Timer Host Phys Addr 1: UCS 451 160.20.0.10 08-00-2b-39-c7-ac 2: UC 0 160.20.0.100 aa-00-04-00-8d-13 3: UC 3 160.20.0.173 00-00-f8-45-a0-b4 4: UC 14 160.20.32.94 00-00-f8-00-f7-41 5: UC 50 160.20.64.69 00-d0-b7-19-78-a4 6: UCS 9 160.20.64.132 00-50-8b-72-7f-ff 7: UCS 150 160.20.80.124 00-50-8b-4d-91-b3 . . .

The following TCP/IP Services management commands allow you to configure the hardware addresses for remote IP addresses:

• SET ARP allows you to add the hardware address to the ARP table.
• SET PROTOCOL ARP allows you specify the time interval for ARP to hold information in its cache. Use the SET CONFIGURATION PROTOCOL ARP command to set this information in the permanent configuration database.

For more information about these commands, refer to the HP TCP/IP Services for OpenVMS Management Command Reference manual.

For information about using the arp utility, refer to Appendix A.

1.2.4 Examining Network Statistics

Use the netstat utility or the SHOW INTERFACE command to check interface and protocol statistics, per-connection status, and memory buffer use. Look for bad checksums, excessive retransmissions, dropped packets, out-of-order packets, and lost-carrier errors.

For example:

TCPIP> netstat -i Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll TN0* 1280 Link Link#2 0 0 0 0 0 WF0 4470 Link 00:00:f8:cd:1e:e4 48855499 0 2035244 0 0 WF0 4470 16.20 ucxaxp 48855499 0 2035244 0 0 LO0 4096 Link Link#1 165084 0 165084 0 0 LO0 4096 127 LOCALHOST 165084 0 165084 0 0

Some problems to look for are:

• If the output of the netstat -i command shows excessive amounts of input errors (Ierrs), output errors (Oerrs), or collisions (Coll), this may indicate a network problem; for example, cables may not be connected properly or the Ethernet may be saturated.
• The netstat -m command shows statistics for network-related data structures. Use this command to determine if the network is using an excessive amount of memory in proportion to the number of sockets in use.
• The netstat -an displays allocated sockets (each socket results in a network connection).

The following example shows the output of the netstat -m command:

TCPIP> netstat -m 1328 mbufs in use: 2 mbufs allocated to data 2 mbufs allocated to ancillary data 139 mbufs allocated to socket structures (1) 244 mbufs allocated to protocol control blocks (2) 442 mbufs allocated to routing table entries 2 mbufs allocated to socket names and addresses 26 mbufs allocated to interface addresses 1 mbufs allocated to ip multicast options 2 mbufs allocated to ip multicast addresses 5 mbufs allocated to interface multicast addresses 48 mbufs allocated to NFS request header 1 mbufs allocated to vnode struct 32 mbufs allocated to kern credential data structure 2 mbufs allocated to mbuf extra-data protocol message 58 mbufs allocated to assorted NFS structures 6 mbufs allocated to network interface structure 2 mbufs allocated to netisr thread queues 5 mbufs allocated to Inet PCB queues 1 mbufs allocated to rad specific structures 1 mbufs allocated to OpenVMS Cluster Alias table 37 mbufs allocated to OpenVMS Kernel VCI structure 12 mbufs allocated to OpenVMS TCPIP Timer structure 3 mbufs allocated to OpenVMS LAN VCI VCIB structure 3 mbufs allocated to OpenVMS LAN MCAST_REQ structure 12 mbufs allocated to OpenVMS SELECT structure 1 mbufs allocated to OpenVMS ACP Filter Buffer 1 mbufs allocated to OpenVMS ACP AQB 1 mbufs allocated to OpenVMS ACP INETCB 2 mbufs allocated to OpenVMS Driver requested REQCB 26 mbufs allocated to OpenVMS ACP allocated SERV Structure 37 mbufs allocated to OpenVMS VCI context block 1 mbufs allocated to OpenVMS ACP IPCACHE Structure 57 mbufs allocated to OpenVMS PROXY correlation records 66 mbufs allocated to OpenVMS PROXY host records 14 mbufs allocated to OpenVMS PROXY local user records 17 mbufs allocated to OpenVMS PROXY remote user records 17 mbufs allocated to OpenVMS Unix emulation stack (NFS, et al)

1. This line indicates there are 24 sockets in use (1 mbuf allocated for each socket).
2. There are two protocol control blocks allocated for each TCP socket and one protocol control block for each UDP socket. The 35 mbuf listed is a mix of PCBs allocated for TCP and UDP sockets. Output from the TCPIP SHOW DEVICE_SOCKET command will tell you how many TCP and UDP sockets are allocated.

By comparing the information output from the netstat -m and the TCPIP command SHOW DEVICE_SOCKET, you can estimate whether the system is using an excessive amount of memory for the number of allocated sockets.

If you sense that TCP/IP Services is using an excessive amount of memory for the number of sockets, there may be a memory leak. Capture the output from the netstat -m and the TCPIP SHOW DEVICE_SOCKET commands and save for documenting the condition.

Table 1-2 shows variations of the netstat command that can reveal network problems.

Table 1-2 netstat Commands

Command	Purpose
netstat -p ip	Checks for bad checksums, length problems, excessive redirects, and packets lost because of resource problems.
netstat -p tcp	Checks for retransmissions, out of order packets, and bad checksums.
netstat -p udp	Looks for bad checksums and full sockets.
netstat -rs	Obtains routing statistics.
netstat -s	Simultaneously displays statistics related to the IP, ICMP, TCP, and UDP protocol layers.
netstat -is	Checks for network device driver errors.

For more information about netstat , see Appendix A.

1.2.5 Monitoring Network Traffic

You can use either of the following to monitor network traffic:

• The TCPTRACE command, described in Section 1.2.5.1
• The tcpdump utility, described in Section 1.2.5.2

The trace utility (TCPTRACE) is a tool you can use to trace packets going in and out of the system. To run the trace utility, enter the DCL command TCPTRACE. Use the qualifiers listed in the command reference section to customize tracing for your particular problem. For example:

$ TCPTRACE HOST1 /FULL /PORT=REMOTE=21 $ TCPTRACE HOST2 /PORT=(LOCAL=23, REMOTE=1056) /FULL /PACKETS=30 /OUTPUT=TELNET_TRACE.TXT

The following sample is a TCPTRACE display:

TCPIP INTERnet trace RCV packet seq # = 1 at 23-OCT-1998 15:19:33.29 IP Version = 4, IHL = 5, TOS = 00, Total Length = 217 = ^x00D9 IP Identifier = ^x0065, Flags (0=0,DF=0,MF=0), Fragment Offset = 0 = ^x0000, Calculated Offset = 0 = ^x0000 IP TTL = 32 = ^x20, Protocol = 17 = ^x11, Header Checksum = ^x8F6C IP Source Address = 16.20.168.93 IP Destination Address = 16.20.255.255 UDP Source Port = 138, UDP Destination Port = 138 UDP Header and Datagram Length = 197 = ^x00C5, Checksum = ^x0E77 5DA81410 8F6C1120 00000065 D9000045 0000 E...awe.....l....] | 0E77C500 8A008A00 | FFFF1410 0010 ..........w.

For more information about using TCPTRACE, see Appendix A.

1.2.5.2 Using TCPDUMP

The OpenVMS tcpdump utility can trace natively on Ethernet or can format traces taken on another host. It communicates with the TCP/IP kernel in copy-all mode so it only can trace packets received or transmitted by the TCP/IP kernel.

The trace can be taken interactively and ended with Ctrl/C, or continue until a packet count has been reached (specified using -c count ). The tcpdump utility displays a summary line indicating the number of packets traced and the number of packets discarded by the kernel.

To use tcpdump , no special TCP/IP Services configuration is required. The process using tcpdump must have OPER, PSWAPM, and CMKRNL privileges.

The format and options are described in Appendix A. This section describes:

• How to build expressions ( Section 1.2.5.2.1)
• How to analyze output from tcpdump ( Section 1.2.5.3)
• Restrictions on using OpenVMS tcpdump ( Section 1.2.5.4)
• How to reduce discarded packets ( Section 1.2.5.5)

The expression is used to select the packets to dump. If no expression is given, all packets on the network are dumped. Otherwise, only packets for which expression is TRUE are dumped.

The expression consists of one or more primitives. Primitives usually consist of an identifier (name or number) preceded by one or more of the keywords described in Table 1-3.

Table 1-3 tcpdump Keywords

Keyword	Definition
type	Defines the object to which the ID name or number refers. The following types are allowed: host net port For example: host foo net 128.3 port 20 If no type keyword is specified, host is the default.
dir	Specifies a particular transfer direction to or from id. The following directions are allowed: src dst src or dst src and dst For example: src foo dst net 128.3 src or dst port 20 src and dst port 123 If no dir keyword is specified, src or dst is the default.
proto	Restricts the match to a particular protocol. The following protocols are allowed: ether ip ipv6 icmpv6 arp tcp udp For example: ether src foo arp net 128.3 tcp port 21 If no proto keyword is specified, all protocols consistent with the type are assumed. For example, src foo means: (ip or arp or rarp) src foo (Note that the latter is not valid syntax.) net bar means: (ip or arp) net bar port 53 means: (tcp or udp) port 53

1.2.5.2.2 Keywords for Filtering Traces from non-OpenVMS Systems

To filter a trace taken on another platform, the following keywords are available:

• ether
• fddi
• ip
• ipv6
• icmpv6
• arp
• rarp
• decnet
• lat
• moprc
• mopdl
• tcp
• udp

Primitive keywords include:

• gateway
• broadcast
• less
• greater
• Arithmetic expressions

More complex filter expressions are formed by using the words and , or , and not to combine primitives. For example:

host foo and not port ftp and not port ftp-data

To minimize keystrokes, identical keyword lists can be omitted. For example, the following two lines are treated the same:

tcp dst port ftp or ftp-data or domain tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain

1.2.5.2.4 Primitive Expressions

The following list describes the results of using some primitive expressions.

• dst host host
  True if the IP destination field of the packet is host, which may be either an address or a name.
• src host host
  True if the IP source field of the packet is host.
• host host
  True if either the IP source or destination of the packet is host. The following keywords can precede any of these host expressions:
  • ip
  • arp
  • rarp
  
  The following examples are equivalent:

  ip host host ether proto ip and host host

  
  If host is a name with multiple IP addresses, each address is checked for a match.

• ether dst ehost
  True if the Ethernet destination address is ehost.
• ether src ehost
  True if the Ethernet source address is ehost.
• ether host ehost
  True if either the Ethernet source or destination address is ehost.
• gateway host
  True if the packet used host as a gateway. That is, the Ethernet source or destination address was host but neither the IP source nor the IP destination was host.
  This expression is equivalent to the following:

  ether host ehost and not host host

  
  You can use either names or numbers for host and ehost.

• dst net net
  (IPv4 networks only) True if the IP destination address of the packet has a network number of net, which may be either an address or a name.
• src net net
  (IPv4 networks only) True if the IP source address of the packet has a network number of net.
• net net
  (IPv4 networks only) True if either the IP source or destination address of the packet has a network number of net.
• dst port port
  True if the packet is IP/TCP or IP/UDP and has a destination port value of port.
• src port port
  True if the packet has a source port value of port.
• port port
  True if either the source or destination port of the packet is port. The following keywords can precede any of these port expressions:
  • tcp
  • udp
  
  For example, the following example matches only TCP packets:

  tcp src port port

• less length
  True if the packet has a length less than or equal to length. The following example is equivalent:

  len <= length

• greater length
  True if the packet has a length greater than or equal to length. The following example is equivalent:

  len >= length

• ip proto protocol
  True if the packet is an IP packet of protocol type protocol. The protocol can be a number, or one of the following names:
  • ipv6
  • icmp
  • icmpv6
  • udp
  • nd
  • tcp
• ether broadcast
  True if the packet is an Ethernet broadcast packet. The ether keyword is optional.
• ip broadcast
  (IPv4 networks only) True if the packet is an IP broadcast packet. It checks for both the all-zeroes and all-ones broadcast conventions, and looks up the local subnet mask.
• ether multicast
  True if the packet is an Ethernet multicast packet. The ether keyword is optional. This is shorthand for:

  ether[0] & 1 != 0

• ip multicast
  (IPv4 networks only) True if the packet is an IPv4 multicast packet.
• ether proto protocol
  True if the packet is of protocol type ether . The protocol argument can be a number or a name, such as ip , ipv6 , and arp .
  Only Ethernet is supported with protocols ip , ipv6 and arp for native tracing. If reading a trace created on another platform, tcpdump will be able to filter and format it correctly.
• expr relop expr
  True if the relation holds, where relop is one of the following:
  • >
  • <
  • >=
  • <=
  • =
  • ,
  • !=
  
  expr is an arithmetic expression composed of integer constants (expressed in standard C syntax), the normal binary operators [+, -, *, /, &, |], a length operator, and special packet data accessors.