ISILON：如何在跨所有节点的多个接口上以合规性模式运行 tcpdump？

Summary: 合规性模式需要对支持人员常用的 tcpdump 命令稍作改动。

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

  1. 创建一个文件夹以保存数据包捕获。 
    1. mkdir -p /ifs/data/tcpdump/$(date +%F)

# Writes to Isilon_Support are protected, use /ifs/data/tcpdump/ instead.
  2. 开始捕获。 
    1. sudo isi_for_array 'for iface in `ifconfig | grep -B3 ether | grep flags | grep -v ISIINTERNAL | cut -d ":" -f1`; do echo `hostname`; sudo tcpdump -i $iface -s1000 -w /ifs/data/tcpdump/$(date +%F)/`hostname`_"$iface"_$(date +%F_%H%M%S).pcap &; done'

# Press Ctrl+C to return to the shell prompt after all tcpdumps have started.
# See the notes for expected output. (There are a number of errors that don't affect the capture)
  3. 验证捕获是否正在运行。 
    1. sudo isi_for_array "ps -auwwxx | grep tcpdump | grep -v grep"
  4. 重现问题。
  5. 停止捕获并验证它已在所有节点上停止。 
    1. sudo isi_for_array "sudo killall tcpdump"
sudo isi_for_array "ps -auwwxx | grep tcpdump | grep -v grep"

# See notes for expected output
  6. 上传包含日志集的捕获。 
    1. sudo isi_gather_info -f /ifs/data/tcpdump/$(date +%F)

Additional Information

运行捕获时，可能会意外地看到许多有关“do”的错误;这些可以忽略。
下面显示了成功的捕获开始：

Isilon-1% sudo isi_for_array 'for iface in `ifconfig | grep -B3 ether | grep flags | grep -v ISIINTERNAL | cut -d ":" -f1`; do echo `hostname`; sudo tcpdump -i $iface -s1000 -w /ifs/data/tcpdump/$(date +%F)/`hostname`_"$iface"_$(date +%F_%H%M%S).pcap &; done'

Syntax error: "do" unexpected
Syntax error: "do" unexpected
Syntax error: "do" unexpected
Isilon-1: Isilon-1
Isilon-3: Isilon-3
Isilon-1: Isilon-1
Isilon-2: Isilon-2
Isilon-1: tcpdump: WARNING: unable to contact casperd
Isilon-1: tcpdump: WARNING: em2: no IPv4 address assigned
Isilon-1: tcpdump: WARNING: unable to contact casperd
Isilon-1: tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 1000 bytes
Isilon-1: tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size 1000 bytes
Isilon-3: Isilon-3
Isilon-3: tcpdump: WARNING: em1: no IPv4 address assigned
Isilon-3: tcpdump: WARNING: unable to contact casperd
Isilon-3: tcpdump: WARNING: em2: no IPv4 address assigned
Isilon-3: tcpdump: WARNING: unable to contact casperd
Isilon-3: tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 1000 bytes
Isilon-3: tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size 1000 bytes
Isilon-2: Isilon-2
Isilon-2: tcpdump: WARNING: em2: no IPv4 address assigned
Isilon-2: tcpdump: WARNING: unable to contact casperd
Isilon-2: tcpdump: WARNING: em1: no IPv4 address assigned
Isilon-2: tcpdump: WARNING: unable to contact casperd
Isilon-2: tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size 1000 bytes
Isilon-2: tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 1000 bytes

# Pressed Ctrl+C to return to shell
Isilon-1%

When checking running processes, expect to see something like the following:

Isilon-1% sudo isi_for_array "ps -auwwxx | grep tcpdump | grep -v grep"
Isilon-3: root      71317   0.0  0.3  90240  6188  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-3_2018-09-14_152532.pcap
Isilon-3: root      71322   0.0  0.3  90240  6188  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-3_2018-09-14_152532.pcap
Isilon-3: root      71323   0.0  0.4  70236  7816  -  SN    3:25PM     0:00.02 tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-3_2018-09-14_152532.pcap
Isilon-3: root      71324   0.0  0.4  70236  7820  -  SN    3:25PM     0:00.02 tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-3_2018-09-14_152532.pcap
Isilon-1: root      76007   0.0  0.3  89984   6088  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-1_2018-09-14_152532.pcap
Isilon-1: root      76012   0.0  0.3  89984   6088  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-1_2018-09-14_152532.pcap
Isilon-1: root      76013   0.0  0.4  70236   7736  -  SN    3:25PM     0:00.02 tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-1_2018-09-14_152532.pcap
Isilon-1: root      76014   0.0  0.4  70236   7736  -  SN    3:25PM     0:00.02 tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-1_2018-09-14_152532.pcap
Isilon-2: root      51721   0.0  0.3  90240  6180  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-2_2018-09-14_152532.pcap
Isilon-2: root      51726   0.0  0.3  90240  6180  -  SN@   3:25PM     0:00.01 sudo tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-2_2018-09-14_152532.pcap
Isilon-2: root      51727   0.0  0.4  70236  7752  -  SN    3:25PM     0:00.02 tcpdump -i em2 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-2_2018-09-14_152532.pcap
Isilon-2: root      51728   0.0  0.4  70236  7752  -  SN    3:25PM     0:00.02 tcpdump -i em1 -s1000 -w /ifs/data/tcpdump/2018-09-14/Isilon-2_2018-09-14_152532.pcap

After killing tcpdump, expect to see the following:

Isilon-1% sudo isi_for_array "ps -auwwxx | grep tcpdump | grep -v grep"
Isilon-2 exited with status 1
Isilon-1 exited with status 1
Isilon-3 exited with status 1

Affected Products

Isilon
Article Properties
Article Number: 000019451
Article Type: How To
Last Modified: 22 May 2025
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.