I have a program which collects a TCPIP packet trace on z/OS and creates a file which can be read by Wireshark on a work station.
(Wireshark display the traffic in a GUI, and interprets fields, etc. So can sort, filter, extract etc. It is THE packet Analyzer).
This has several advantages,
- it is easy to collect, you do not need to do a CTRACE, and use IPCS.
- you can use wireshark to decode the TLS handshake, and look at the flows. (Ive already found this useful)
- You can use the wireshark smarts to plot statistics ( eg buffer size over time) etc about the flow of traffic, all the good stuff you get as standard in Wireshark.
I'm thinking of making it available through a github site.
Question: Is there any reason why I should not make this generally available?
It uses documented interfaces, so anyone could have done it.
Feel free to contact me offline.
Colin
------------------------------
Colin Paice
------------------------------