How to format IBM i TRCCNN and CMNTRC communication traces to .pcap files (Wireshark format)

Answer

Below are the instructions on how to capture traces and format them for wireshark.


First make sure you have PTF MF59962 (R720) or MF59955 (R710) applied to your system, then follow instructions below for either Communication Traces, or Trace Connections depending on which you have been asked to collect

Communication traces

1. If necessary, delete any previous trace for the line description.  You can check to see if one exists by running command:
   CHKCMNTRC CFGOBJ(line_name) CFGTYPE(*LIN)
   and if it does, you can delete it using command:
   DLTCMNTRC CFGOBJ(line_name) CFGTYPE(*LIN)
   In both cases you will need to substitute line_name with the name of the Ethernet line description you are tracing.
2. Start the communications trace by running command:
   STRCMNTRC CFGOBJ(line_name) CFGTYPE(*LIN) MAXSTG(32M) USRDTA(*MAX)
   where line_name is replaced with the name of the Ethernet line description you are tracing
3. Recreate the failure scenario
4. End the communications trace by running command:
   ENDCMNTRC CFGOBJ(line_name) CFGTYPE(*LIN)
   again where line_name is replaced with the name of the Ethernet line description you are tracing
5. Create an IFS .pcap file with the output of the trace by running command:
   DMPCMNTRC CFGOBJ(line_name) CFGTYPE(*LIN) TOSTMF('/path/filename.pcap') REPLACE(*YES) FORMAT(*PCAP)
   again substituting your line name, and replacing '/path/filename.pcap' with your own path and filename, e.g. '/home/usera/ibmcomtrace.pcap'

Trace Connections

1. Start the Trace Connection trace by running command:
   TRCCNN SET(*ON) TRCTYPE(*IP) TRCTBL(TCPIP) SIZE(300 *MB)
2. Recreate the failure scenario
3. End the trace and create an IFS .pcap file with the trace output by running command:
   TRCCNN SET(*OFF) TRCTBL(TCPIP) OUTPUT(*STMF) TOSTMF('/path/filename.pcap' *YES)
   replacing '/path/filename.pcap' with your own path and filename, e.g. '/home/usera/ftp_failure.pcap'