z/OS TCP/IP activity trace

The TCP/IP CTRACE and Packet Trace are normally maintained in a set of cyclical buffers in memory. However, they can also be recorded to a file with a component trace. When they are maintained in memory, a dump must be taken to capture the diagnostic information for debugging purposes.

To start the TCP/IP CTRACE from the console, enter:

TRACE CT,ON,COMP=SYSTCPIP,SUB=(tcpipprocname)
R XX,JOBNAME=(nfsprocname,tcpipprocname) 
R XX,OPTIONS=(ENGINE,PFS,SOCKET,INTERNET,TCP,UDP,IOCTL),END

To start the TCP/IP packet trace from the console, enter:

TRACE CT,ON,COMP=SYSTCPDA,SUB=(tcpipprocname)
V TCPIP,tcpipprocname,PKTTRACE,ON,ABBREV=152,IP=xx.xx.xx.xx

In this example, xx.xx.xx.xx is the client_IP_address.

Reproduce the problem in a system with minimal activity.

To collect a dump of the TCPIP address space, issue the following console command:

DUMP COMM=('text') 
R xx,JOBNAME=(tcpipprocname,nfsprocname), 
SDATA=(ALLNUC,PSA,GRSQ,SUM,CSA,LPA,LSQA,RGN,SWA,SQA,TRT),END

See z/OS dump.

To turn TCP/IP CTRACE off, issue the following console command:

TRACE CT,OFF,COMP=SYSTCPIP,SUB=(tcpipprocname)
V TCPIP,tcpipprocname,PKT,OFF,IP=xx.xx.xx.xx

To stop the TCPIP Packet trace, issue the following console command:
```
TRACE CT,OFF,COMP=SYSTCPDA,SUB=(tcpipprocname) 
```

Note: The first step to collecting traces is to ensure that the bufsize in SYS1.PARMLIB member CTIEZB00 is set to at least 8 MB, which is the default value. It may need to be set higher depending on the amount of trace diagnostic information desired, but 8 MB should be used as a minimum. Using the maximum buffer size of 1024 MB, you will be sure that the maximum amount of contiguous trace diagnostic information is captured. A minimum of 256 MB buffer size is recommended.

TCP/IP will need to be restarted for the change in buffer size to take affect. The trace diagnostic information will be captured using a z/OS dump command. Be aware that this method may result in lost trace diagnostic information as the possibility of wrapping is high. The dump command should be issued soon after the problem occurs.