pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


tshark log: Two mounts, one pubfh, one rootfh
Posted by Anonymous on Fri 12th Jul 2024 14:12
raw | new post

  1. root@DERFWNB4966:~# tshark -f "port 2049" -d "tcp.port==2049,rpc"
  2. Running as user "root" and group "root". This could be dangerous.
  3. Capturing on 'enp0s25'
  4.     1 0.000000000 10.49.202.232 ? 10.49.202.230 TCP 74 600 ? 2049 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=110595 TSecr=0
  5.     2 0.000027553 10.49.202.230 ? 10.49.202.232 TCP 74 2049 ? 600 [SYN, ACK] Seq=0 Ack=1 Win=33304 Len=0 MSS=1460 SACK_PERM=1 TSval=1138206091 TSecr=110595 WS=128
  6.     3 0.000282617 10.49.202.232 ? 10.49.202.230 TCP 66 600 ? 2049 [ACK] Seq=1 Ack=1 Win=8388608 Len=0 TSval=110595 TSecr=1138206091
  7.     4 0.001403554 10.49.202.232 ? 10.49.202.230 NFS 110 V4 NULL Call
  8.     5 0.001421545 10.49.202.230 ? 10.49.202.232 TCP 66 2049 ? 600 [ACK] Seq=1 Ack=45 Win=33280 Len=0 TSval=1138206093 TSecr=110595
  9.     6 0.001460412 10.49.202.230 ? 10.49.202.232 NFS 94 V4 NULL Reply (Call In 4)
  10.     7 0.002078494 10.49.202.232 ? 10.49.202.230 NFS 430 V4 Call exchange_id EXCHANGE_ID
  11.     8 0.002143858 10.49.202.230 ? 10.49.202.232 NFS 190 V4 Reply (Call In 7) exchange_id EXCHANGE_ID
  12.     9 0.006545550 10.49.202.232 ? 10.49.202.230 NFS 298 V4 Call create_session CREATE_SESSION
  13.    10 0.007278251 10.49.202.230 ? 10.49.202.232 NFS 210 V4 Reply (Call In 9) create_session CREATE_SESSION
  14.    11 0.007820496 10.49.202.232 ? 10.49.202.230 NFS 214 V4 Call reclaim_complete RECLAIM_COMPLETE
  15.    12 0.050615351 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 11) reclaim_complete RECLAIM_COMPLETE
  16.    13 0.051437624 10.49.202.232 ? 10.49.202.230 NFS 214 V4 Call getattr PUTPUBFH | GETATTR
  17.    14 0.051517025 10.49.202.230 ? 10.49.202.232 NFS 190 V4 Reply (Call In 13) getattr PUTPUBFH | GETATTR
  18.    15 0.053151619 10.49.202.232 ? 10.49.202.230 NFS 258 V4 Call lookup LOOKUP bigdisk
  19.    16 0.053216026 10.49.202.230 ? 10.49.202.232 NFS 518 V4 Reply (Call In 15) lookup LOOKUP
  20.    17 0.053935640 10.49.202.232 ? 10.49.202.230 NFS 246 V4 Call getfsattr OPENATTR
  21.    18 0.053982304 10.49.202.230 ? 10.49.202.232 NFS 290 V4 Reply (Call In 17) getfsattr OPENATTR Status: NFS4ERR_NOTSUPP
  22.    19 0.054733716 10.49.202.232 ? 10.49.202.230 NFS 246 V4 Call getfsattr OPENATTR
  23.    20 0.054775008 10.49.202.230 ? 10.49.202.232 NFS 290 V4 Reply (Call In 19) getfsattr OPENATTR Status: NFS4ERR_NOTSUPP
  24.    21 0.090352836 10.49.202.232 ? 10.49.202.230 NFS 254 V4 Call lookup LOOKUP DH: 0x1306cd55/Desktop.ini
  25.    22 0.090404506 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 21) lookup LOOKUP Status: NFS4ERR_NOENT
  26.    23 0.093072806 10.49.202.232 ? 10.49.202.230 NFS 254 V4 Call lookup LOOKUP DH: 0x1306cd55/AutoRun.inf
  27.    24 0.093118843 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 23) lookup LOOKUP Status: NFS4ERR_NOENT
  28.    25 0.144905807 10.49.202.232 ? 10.49.202.230 TCP 66 600 ? 2049 [ACK] Seq=1865 Ack=1645 Win=8388352 Len=0 TSval=110740 TSecr=1138206184
  29.    26 26.455313545 fe80::21b:1bff:fec3:7713 ? fe80::219:99ff:feae:73ce NFS 210 V4 Call SEQUENCE
  30.    27 26.455638564 fe80::219:99ff:feae:73ce ? fe80::21b:1bff:fec3:7713 NFS 170 V4 Reply (Call In 26) SEQUENCE
  31.    28 26.455657953 fe80::21b:1bff:fec3:7713 ? fe80::219:99ff:feae:73ce TCP 86 734 ? 2049 [ACK] Seq=125 Ack=85 Win=2767 Len=0 TSval=3429105775 TSecr=2708454445
  32. ^C28 packets captured
  33. root@DERFWNB4966:~# tshark -f "port 2049" -d "tcp.port==2049,rpc"
  34. Running as user "root" and group "root". This could be dangerous.
  35. Capturing on 'enp0s25'
  36.     1 0.000000000 10.49.202.232 ? 10.49.202.230 TCP 74 601 ? 2049 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=165731 TSecr=0
  37.     2 0.000032331 10.49.202.230 ? 10.49.202.232 TCP 74 2049 ? 601 [SYN, ACK] Seq=0 Ack=1 Win=33304 Len=0 MSS=1460 SACK_PERM=1 TSval=1138261226 TSecr=165731 WS=128
  38.     3 0.000290828 10.49.202.232 ? 10.49.202.230 TCP 66 601 ? 2049 [ACK] Seq=1 Ack=1 Win=8388608 Len=0 TSval=165731 TSecr=1138261226
  39.     4 0.001591155 10.49.202.232 ? 10.49.202.230 NFS 110 V4 NULL Call
  40.     5 0.001610040 10.49.202.230 ? 10.49.202.232 TCP 66 2049 ? 601 [ACK] Seq=1 Ack=45 Win=33280 Len=0 TSval=1138261228 TSecr=165731
  41.     6 0.001648952 10.49.202.230 ? 10.49.202.232 NFS 94 V4 NULL Reply (Call In 4)
  42.     7 0.002136757 10.49.202.232 ? 10.49.202.230 NFS 430 V4 Call exchange_id EXCHANGE_ID
  43.     8 0.002203246 10.49.202.230 ? 10.49.202.232 NFS 190 V4 Reply (Call In 7) exchange_id EXCHANGE_ID
  44.     9 0.002473994 10.49.202.232 ? 10.49.202.230 NFS 298 V4 Call create_session CREATE_SESSION
  45.    10 0.004131175 10.49.202.230 ? 10.49.202.232 NFS 210 V4 Reply (Call In 9) create_session CREATE_SESSION
  46.    11 0.004613159 10.49.202.232 ? 10.49.202.230 NFS 214 V4 Call reclaim_complete RECLAIM_COMPLETE
  47.    12 0.044442403 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 11) reclaim_complete RECLAIM_COMPLETE
  48.    13 0.044815272 10.49.202.232 ? 10.49.202.230 NFS 214 V4 Call getattr PUTROOTFH | GETATTR
  49.    14 0.044894124 10.49.202.230 ? 10.49.202.232 NFS 190 V4 Reply (Call In 13) getattr PUTROOTFH | GETATTR
  50.    15 0.049206302 10.49.202.232 ? 10.49.202.230 NFS 258 V4 Call lookup LOOKUP bigdisk
  51.    16 0.049289860 10.49.202.230 ? 10.49.202.232 NFS 518 V4 Reply (Call In 15) lookup LOOKUP
  52.    17 0.075252884 10.49.202.232 ? 10.49.202.230 NFS 254 V4 Call lookup LOOKUP DH: 0x1306cd55/Desktop.ini
  53.    18 0.075327657 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 17) lookup LOOKUP Status: NFS4ERR_NOENT
  54.    19 0.076998174 10.49.202.232 ? 10.49.202.230 NFS 254 V4 Call lookup LOOKUP DH: 0x1306cd55/AutoRun.inf
  55.    20 0.077047556 10.49.202.230 ? 10.49.202.232 NFS 174 V4 Reply (Call In 19) lookup LOOKUP Status: NFS4ERR_NOENT
  56.    21 0.121100033 10.49.202.232 ? 10.49.202.230 TCP 66 601 ? 2049 [ACK] Seq=1505 Ack=1197 Win=8387328 Len=0 TSval=165852 TSecr=1138261303
  57.    22 4.918061500 10.49.202.232 ? 10.49.202.230 NFS 198 V4 Call sequence SEQUENCE
  58.    23 4.918134636 10.49.202.230 ? 10.49.202.232 NFS 158 V4 Reply (Call In 22) sequence SEQUENCE
  59.    24 4.964899812 10.49.202.232 ? 10.49.202.230 TCP 66 600 ? 2049 [ACK] Seq=133 Ack=93 Win=32767 Len=0 TSval=170696 TSecr=1138266144
  60. ^C24 packets captured

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at