AIX

I am sorry for incomplete information.

Here are the details.
OS-AIX 6.1
User:root
tcpdump on AIX

1. tcpdump Command:
tcpdump -I -i en? host YOUR_PRINTER_DNS_NAME_OR_IP
2. Result:
tcpdump: BIOCSETIF: en0: Do not specify an existing file.

1. iptrace command:
/usr/sbin/iptrace -a -i en0 iptrace.out &
2. Give print to printer:
lp -d queue_name file_name
3. view the process:
ps -ef | grep iptrace
4. Kill the process:
kill -1 process_id
5. Report:
ipreport -r -s iptrace.out >/ipreport.network
6. view ipreport.network:
more ipreport.network

I could see network packets (TCP) captured in ipreport.network.

Reference:
Optimizing AIX 5L performance: Tuning network performance, Part 3

As explained in The Wireshark Network Analyzer 1.1.2, Wireshark can read / import the following file formats:
AIX's iptrace captures

I have configure Wireshark in Windows. I copied ipreport.network to windows pc and then tried to open it using wireshark. I got the error message "The file format is not supported".

Will ethereal compile in AIX 6.1 also..

Please let me know if more information is required.

Hi,

Thank you all for your support.

I am able to capture all network packets using the below commands.

1. startsrc -s iptrace -a "-i en1 /home/testing/iptrace/iptracelog"
2. print
3. stopsrc -s iptrace

Ref:Optimizing AIX 5L performance: Tuning network performance, Part 3

Thank you all...

Hi,

Thank you all for your support.

I am able to capture all network packets using the below commands.

1. startsrc -s iptrace -a "-i en1 /home/testing/iptrace/iptracelog"
2. print
3. stopsrc -s iptrace

Ref:Optimizing AIX 5L performance: Tuning network performance, Part 3

I am able to view the captured file using Wireshark also.

Thank you all...

Thank you

Does the traffic flow over the first interface? What happens if you just do
# tcpdump host <printer_ip>
If it works add -vvv option to get more packet information.

Using iptrace with AIX became somewhat old fashioned since tcpdump entered AIX (at version 4.2 or so) hence I still recommend using tcpdump instead. I consider it possible that AIX iptrace output is somewhat "different" than what current versions of Wireshark expect. If you insist on using iptrace make sure that the file is not damaged during transfer.

Opposed to the link information bakunin supplied Wireshark compiles fine long since at least 0.9.9.5. on AIX 5.3 but you need to know your AIX to prepare the environment correctly. Hint: if you want to compile Wireshark yourself GNU compilers (current versions) seem to me more suitable for this job than the IBM compilers. However, to catch simple TCP packets even Ethereal (Wireshark's predecessor) might suffice. Ethereal 0.8.x.x has been available from the IBM AIX Linux Toolbox for years now.

The command tcpdump which you have mentioned gives error.

bash-3.2# tcpdump host 10.116.26.156
tcpdump: no suitable device found

I will try to download and use Ethereal.

Don't use bash when debuging AIX problems. AIX default shell is ksh. Using this oh so compatible "bash" or other non default shell will work just like AIX ksh in 99.9% of the time and the missing 0.1% compatibility might cause you many headaches.

If tcpdump complains about "no suitable device found" Ethereal/Wireshark won't work either.

Make sure that filest bos.net.tcp.adt is installed on your server. Then check whether the Berkeley Paket Filters are there: /dev/bpfx (with x being a number ranging from 0 to 3, i.e. four devices). These filters are not available per default. You need to run tcpdump from AIX (NOT from the Toolbox or any other source) once to get these filters created. Afterwards any tcpdump version should work.