You can use expressions and the actual NFS headers themselves in an attempt to filter out problem packets and isolate issues, some of which i found useful are below:
NFS Procedures:
Nfs.procedures_v3==var
You can get the var from here which will give you the UID’s to search on, i.e. to search for NFSv3_WRITE packets, you can run the wireshark filter:
Nfs.procedures_v3==7
As per “Procedure 7: WRITE – Write to file” on the link. This will show you all the files written to in the capture. The same premise applies for the other 21 procedures listed.
NFS Status:
Nfs.status==var
Again, you can get the var from here (scroll down to “nfsstat3”). You can use this to filter on the status of the NFS Packet, i.e. “Status: NFS3_OK (0)”, for example if you wanted to search for all NFS packets that were “NFS3ERR_NAMETOOLONG = 63” you would run the expression:
Nfs.status==63
As per “NFS3ERR_NAMETOOLONG = 63” under nfsstat3 in the doc. Again, same applies to the rest of the status UID’s.
Sam.
