Lab 9: File Sharing - NFS
NFS
If you are working at home you will need to be running your own NFS server on a separate machine on your home network to complete this exercise. Follow the instructions with the CD to start up the NPS servers on one of your home machines and note the IP address of that machine.
You will be generating packets by using the "Browser" software that is on the NPS CD. Though this Browser you can view files and directories that are being exported by an NFS server . If you click on a graphics file ( GIF or JPG ) in this Browser it will be displayed in a window - otherwise the browser does not do very much except cause packets to flow!
(((NFSBrowserLaunch)))
If the machine you are working on is running NT the parts of the lab where you actually read files via NFS may have problems.
Testing NFS file access
The files that you can see are stored on the NFS server in the directory that is being exported.
Start by running NetXRay and setting an Advance Filter that will capture only NFS packets -IP/UDP/NFS.
Start a capture.
Double-click on a file. A window will appear with the file name - this will happen when the file has been completely read across the network. If you have selected a GIF file the content will be displayed!
Were any NFS packets captured
Looking at the remote procedure numbers
NFS uses Remote Procedure Call (RPC) to do its work.
RPC allows the client to call procedures on a remote machine. When a client does this it needs to specify what remote program it is using ( in this case "NFS" - identified by a long number ) and then what procedure to call within that program - again identified by a long number.
Start an NFS capture as before
Relaunch the Browser as before
View the capture buffer.
What was the first remote function call
What was the second remote function call
Build up a list of the RPC function calls that implement NFS.
To do this you need to progressively eliminate the codes that you have already identified from your capture by using a Data Pattern Filter. (If you are not sure about this process check the note at the end of this lab sheet). Each time you identify a procedure number you need to add a new procedure number to the list of packets that you will NOT capture.
| Procedure name | Procedure number |
| Lookup | |
| GetAttr | |
| ReadDir | |
| Read | |
Optional extra NFS exercises
(do these at the end of the lab if you have time)
Looking at the NFS file handle
Start an NFS capture as before
Relaunch the Browser as before
Find the NFS File Handle in the NFS section of the packets. The initial capture will always contain the handle for the parent directory of the export.
Note down this handle
To see some other handles you will need to exclude some packets as above - for example ReadDir
Make a series of captures as you browse down through the exported directory and figure out which portion of the file handle changes as you change directories. This is the portion that is needed by the NFS server to identify the UNIX file. The rest of the 32 bytes is padding to accommodate other operating systems that might use NFS. Using a data pattern filter to exclude data
Capture some packets that include the data that you want to exclude ( or include )
Use Capture Filter Settings, Data Pattern to bring up the data pattern screen. Make sure that the top line of the filter definition is highlit.
To exclude packets with certain data use Add NOT followed by Add Pattern. The Edit Pattern dialog includes a browser that looks at the packets that you have just captured. Find a packet that includes the data that you want to exclude, highlight the data, and use Set Data to automatically fill out the fields at the top of the form.
To exclude several different values you require a series of NOT/PAT pairs that are ANDed together. The top line ( blue AND ) can be toggled between AND and OR by clicking or using the button provided.