How to get file from nfs id

[Dan Nelson]

In the last episode (Jul 11), Radek Krejca said:
> Hello,
> 
> I have problem with heavy load of my nfsd server. There is connected about 70 diskless machines, but in readonly mode. I catched traffic and get this:
> 
> 21:00:39.715337 IP diskless-1.3297435097 > storage.nfs: 112 getattr fh Unknown/A27801CEDE115FA30A005CD9080000007ABA42000000000000000000570CDB51
> 21:00:39.716229 IP storage.nfs > diskless-1.3297435097: reply ok 112 getattr REG 444 ids 0/0 sz 64944
> 21:00:39.716463 IP diskless-1.3297435098 > storage.nfs: 112 getattr fh Unknown/A27801CEDE115FA30A0043DE080000007CBA42000000000000000000570CDB51
> 21:00:39.719112 IP storage.nfs > diskless-1.3297435098: reply ok 112 getattr REG 444 ids 0/0 sz 82800
> 21:00:39.719453 IP diskless-1.3297435099 > storage.nfs: 112 getattr fh Unknown/A27801CEDE115FA30A0043DE080000007CBA42000000000000000000570CDB51
> 21:00:39.721636 IP storage.nfs > diskless-1.3297435099: reply ok 112 getattr REG 444 ids 0/0 sz 82800
> 
> Why is the same machine requesting chmod of the same file and is there any
> way to find out name of file from this long id?

You can't get tcpdump to print it, but the getattr reply does include the
inode of the file.  If you start up wireshark and capture the same packets
(or open a capture file created by tcpdump), the inode is stored in the
"nfs->obj_attributes->attributes->fileid" field.  You can then use "find /
-inum 12345" to locate that inode on disk.

-- 
	Dan Nelson
	dnelson at allantgroup.com