Translating IBM i Communication Traces to Wireshark Format

Posted on by Joe Hertvik

ibm i communications traceHere’s something to think about if you want to do your own analysis of an IBM i communications trace (comm trace) using the open-source Wireshark packet analyzer.

By default, an IBM i comm trace outputs to a printer file, which is not readable by Wireshark. But if you’ve opened a ticket with IBM to do comm trace analysis, you can request IBM to convert the comm trace printout into Wireshark format.  Once converted, you just download it from a link IBM will provide.

We just finished a ticket with IBM to set up a comm trace. We put a Wireshark trace on a PC client and started a corresponding comm trace on our IBM i. When finished, we sent both traces to IBM for analysis. After analysis, IBM converted the IBM i trace to Wireshark format, and we downloaded it and gave it to our network for further analysis.

So keep this in mind the next time you need to look at network traffic coming from an IBM i partition. With IBM’s help, you can get the trace data in a open-source format your Intel- and Cisco-centric team can deal with.

joe hertvik linkedin button

Related Posts

About Joe Hertvik

Joe is the owner of Hertvik Business Services, a service company providing written white papers, case studies, and other marketing content to computer industry companies. He is also a contributing editor for IT Jungle and has written the Admin Alert column for the past ten years. Follow Joe Hertvik on Twitter @JoeHertvik. Email Joe for a free quote on white papers, case studies, brochures, or other marketing materials.
This entry was posted in IBM i Tech Info. Bookmark the permalink.

6 Responses to Translating IBM i Communication Traces to Wireshark Format

  1. Ted Holt says:
    December 12, 2013 at 11:41 am

    Yes, I just learned about Wireshark this week. Installed QSPTLIB yesterday. I think we should talk about this in Four Hundred Guru. If you don’t want to, I will.

    • Joe Hertvik says:
      December 12, 2013 at 1:25 pm

      I’m the same as you. I didn’t know that IBM had a Wireshark conversion tool for comm trace, either. That is something I think we should talk and post in Four Hundred Guru or elsewhere.

      Anybody out there have any more information or links to an IBM i Wireshark conversion tool?

  2. bryan dietz says:
    December 16, 2013 at 7:41 am

    In V6.1 there was a PTF that allowed DMPCMNTRC to output in *PCAP format.

    in V7.1 it is builtin.

    Dump Communications Trace (DMPCMNTRC)
    Stream file format . . . . . . . *CMNTRC *CMNTRC, *PCAP

  3. Gary Patterson says:
    December 19, 2013 at 5:35 pm

    We use comm traces to assist in diagnosing comm issues and performance problems. Dumping the trace to PCAP format and using Wireshark is so much better than scanning a spooled file.

    Just used the native V7R1 PCAP support last week diagnosing a problem in a Java application that communicated with a web service to determine precise timings of transmissions and responses.

    PCAP support has been available for years – since V5R3.

    V5R3 & V5R4 convert trace to PCAP format supported via QSPTLIB

    http://iprodeveloper.com/networking/troubleshooting-tcpip-unleash-power-qsptlib-support-library

    V6R1 – PTF for DMPCMNTRC
    V7R1 – Native support for PCAP format

    • Joe Hertvik says:
      December 19, 2013 at 6:10 pm

      Thanks, Gary. I’m getting a good education on this. Looks like the next opportunity I’ll have to use wire shark on IBM I will be next month. Ted Holt is thinking about writing an article on this for Four Hundred Guru.

Comments are closed.