Tracing TCP/IP components

By utilizing the z/OS component trace facility, you can store trace data efficiently (with low system impact) into data sets. After tracing of a failure is complete, IPCS can be used to format and view the data.

The components of TCP/IP that can be traced are:

SYSTCPDA for IP packet tracing
SYSTCPIP for TCP/IP internal event tracing
SYSTCPRT for OMPROUTE tracing
SYSTCPRE for TCP/IP resolver tracing
SYSTCPIS for the TCP/IP intrusion detection services trace

By far, the SYSTCPDA packet trace is the most commonly used component trace. The other trace options are usually utilized only as a result of instructions from IBM support personnel or by advanced TCP/IP system administrators. Consequently, they are not discussed further in this information.

Component trace writes trace data either to memory (the TCP/IP dataspace) or to an external writer program, which writes the data to storage. The following command sequence activates a SYSTCPDA packet trace and stores the unformatted data:

Do the following:

Start the writer for packet tracing:

TRACE CT,WTRSTART=pktwrt

where pktwrt represents the JCL library member name that is used to invoke the external writer program.

Note: When reading a command like the above, the upper case portion represents the actual command itself, while anything in lower case represents a user-supplied parameter. This convention is used throughout z/OS manuals.

Clear any previous packet trace settings:
```
V TCPIP,tcpproc,PKTTRACE,CLEAR
```
where tcpproc identifies the TCP/IP address space.
Start TCPIP packet trace:
```
V TCPIP,tcpproc,PKTTRACE,ON,IPADDR=nn.nn.nn.nn
```
The IP address of the client, nn.nn.nn.nn, was used to filter the packet trace entries to be captured. There are a large number of filters available for a packet trace that are not shown here.
Start packet trace and connect the writer:
```
TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpproc)
R xx,WTR=pktwrt,END
```
where xx is an identifier from the TRACE prompt that asks for TRACE options.
Recreate the problem.

STOP all traces as soon as the problem occurs so that the trace entries do not wrap (component traces write continuously, starting over at the beginning of a data set after it is full).

TRACE CT,OFF,COMP=SYSTCPDA,SUB=(tcpproc)
TRACE CT,WTRSTOP=pktwrt

Note: How do you take a dump from the z/OS console? For TCP/IP, try the following sequence of commands. Note that this includes a dump of the TCP/IP data space, which can contain some internal component trace records useful for diagnosis:

DUMP COMM=(dump title)
R xx,SDATA=(CSA,SQA,RGN,TRT,GRSQ),CONT
R xx,JOBNAME=(tcpproc),CONT
R xx,END

As mentioned, for efficiency, component traces are written without any formatting. IPCS can be used to format component trace entries. In particular, packet traces can be formatted to provide statistical and summary information with respect to any traced connection.