Dismiss
InnovationQ will be updated on Sunday, Oct. 22, from 10am ET - noon. You may experience brief service interruptions during that time.
Browse Prior Art Database

Selective NetBios Tracing by Remote Name

IP.com Disclosure Number: IPCOM000113851D
Original Publication Date: 1994-Oct-01
Included in the Prior Art Database: 2005-Mar-27
Document File: 4 page(s) / 129K

Publishing Venue

IBM

Related People

Baker, RJ: AUTHOR [+3]

Abstract

Large IBM LAN Server* customer environments have difficulty with problem determination using Netbios system traces. Netbios traces capture network frames and Netbios Control Block (NCB) activity on specific machines. One problem is that the 63K trace buffer fills and wraps very quickly and overwrites the previously collected data. On a busy system the buffer can wrap every 2 to 3 seconds. This makes it very difficult to capture the trace data of a network problem. The data may be lost before a user can turn off tracing. The buffer size is a limit of the base system, so that the network layer cannot just allocate more memory for trace buffers.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 46% of the total text.

Selective NetBios Tracing by Remote Name

      Large IBM LAN Server* customer environments have difficulty
with problem determination using Netbios system traces.  Netbios
traces capture network frames and Netbios Control Block (NCB)
activity on specific machines.  One problem is that the 63K trace
buffer fills and wraps very quickly and overwrites the previously
collected data.  On a busy system the buffer can wrap every 2 to 3
seconds.  This makes it very difficult to capture the trace data of a
network problem.  The data may be lost before a user can turn off
tracing.  The buffer size is a limit of the base system, so that the
network layer cannot just allocate more memory for trace buffers.

      Another problem with tracing on large LAN environments is that
the buffer captures mostly irrelevant frames from machines that are
not related to the activity being traced.  This again results in a
constantly wrapping buffer, and also makes the relevant data more
difficult to locate.  Network administrators would often have to sit
at a machine for several hours waiting for a specific problem to
occur, and then enter TRACE OFF at a command line to try to catch the
trace data.  After the trace data is analyzed, it is not uncommon to
find that the buffer wrapped, and the data does not contain the
problem NCBs or frames.

      The solution involves tracing only relevant trace data so that
the trace data is more useful, and the buffer does not fill nearly as
quickly.  To do this it is necessary to understand which NCBs are
relevant to a session between two machines.  Only NCBs are traced
which show activiy between the local and specified remote machine.
Once a session is established between the machines, the Local Session
Number (LSN) is used to trace activity.  This cannot be done at any
level except at the netbios protocol stack layer.  Tables for
specific remote names and LSN numbers are maintained by the protocol
stack.  The user specifies up to 4 remote machine names (or more if
wild card characters are used) in the netbios configuration.  If
tracing is on, a table of active LSNs for these remote machines is
kept and updated whenever sessions with the specified machines go up
or down.  Fields within the NCBs or Netbios headers of frames are
used to determine if the NCB/frame is to be traced.  If the remote
name or LSN does not match a table value, no trace call is made.
This also serves to increase the performance of machines running with
tracing on, since far fewer calls to the system trace facility are
made.

      Although users can use the TRACENAMES parameter in conjuntion
with the TRACEOFF parameter, in most cases that is unnecessary.  Once
a session times out or stops for any reason, so does tracing activity
for that session.  The result is that users do not have to wait at a
machine for a failure to occur, and tracing can be stopped
automatically either using TRACEOFF (if the bad return code is known
...