Hi.

Environment:

$ tcpip sh ver

HP TCP/IP Services for OpenVMS Alpha Version V5.7 - ECO 5
on a COMPAQ AlphaServer DS20E 666 MHz running OpenVMS V8.4-2L2

We use TCPTRACE to monitor network traffic.
It is very helpfull to see the actual data packages that
are on the network when debugging machinery communicaation.

Now, TCPTRACE can only run in one copy at the same time
(on the same VMS system). I guess that has to do with the
way TCPTRACE "jacks" into the tcpip stack...

Does anyone know of any other tool that runs on the VMS system to
monitor network traffic and that can be run in multiple instances?

Regards,

Jan-Erik.

Jan-Erik,

did you try TCPDUMP ? I didn't test to run multiple instances though.

Volker.

Den 2023-03-24 kl. 13:51, skrev Volker Halle:
> Jan-Erik,
>
> did you try TCPDUMP ? I didn't test to run multiple instances though.
>
> Volker.

One session work. Second session gives:

$ tcpdump host 10.32.137.161
$QIO Failed to start trace
LIBPCAP-F-DRVRSTRT, Error while issuing trace startup command to driver
%SYSTEM-F-DEVACTIVE, device is active
$

Den 2023-03-24 kl. 14:43, skrev Jan-Erik Söderholm:
> Den 2023-03-24 kl. 13:51, skrev Volker Halle:
>> Jan-Erik,
>>
>> did you try TCPDUMP ? I didn't test to run multiple instances though.
>>
>> Volker.
>
> One session work. Second session gives:
>
> $ tcpdump host 10.32.137.161
> $QIO Failed to start trace
> LIBPCAP-F-DRVRSTRT, Error while issuing trace startup command to driver
> %SYSTEM-F-DEVACTIVE, device is active
> $
>

Similar to how TCPTRACE reports on the second session:

$ tcptrace 10.32.137.161
%SYSTEM-F-DEVACTIVE, device is active
$

A bit more options to format the output in TCPDUMP...

On 2023-03-24 12:28:29 +0000, Jan-Erik Sderholm said:

> Does anyone know of any other tool that runs on the VMS system to
> monitor network traffic and that can be run in multiple instances?

As an alternative, the tools don't need to run on OpenVMS. Mirror the
switchport, and use Kali or such to capture and process the network
traffic, whether using wireshark, tcpdump or tcpflow or whatever.

Other common options here (more commonly used for shenanigans) include
mitmproxy, ettercap, or bettercap or such. These tools would be choices
for accessing a classic wide-open SCADA design.

OpenVMS has libpcap starting around TCP/IP Services V5.5 or so, and
which provides another approach for monitoring traffic. This is
underneath tcpdump. There doesn't seem to be much doc for this, though.

Local preference is to instrument the apps or (for this case)
instrumenting a common communications framework. That is obviously a
larger effort, but sorting out network communications has paid benefits
with debugging and monitoring and elsewhere, and incidentally also
makes getting to TLS or DTLS easier.

--
Pure Personal Opinion | HoffmanLabs LLC

Den 2023-03-24 kl. 22:13, skrev Stephen Hoffman:
> On 2023-03-24 12:28:29 +0000, Jan-Erik Sderholm said:
>
>> Does anyone know of any other tool that runs on the VMS system to monitor
>> network traffic and that can be run in multiple instances?
>
> As an alternative, the tools don't need to run on OpenVMS.

They do.

> Mirror the switchport,

Not possible.

> Local preference is to instrument the apps or (for this case) instrumenting
> a common communications framework.

Already in place. But what does documentation and specifications
help when you have bugs in the code implementing them...