Analyzing Net trace

47
Oracle Support Services Examining Oracle Net Trace Files Revision: 1.0 Status: Final Version April 25, 2001 By Kevin Reardon Centers of Expertise Oracle Corporation

Transcript of Analyzing Net trace

Page 1: Analyzing Net trace

Oracle Support Services

Examining Oracle Net Trace Files

Revision: 1.0 Status: Final Version

April 25, 2001

By Kevin Reardon

Centers of Expertise

Oracle Corporation

Page 2: Analyzing Net trace

Examining Oracle Net Trace Files Page - 1 April 12, 2001

Table of Contents Introduction ......................................................................................................................... 2 Oracle Net Fundamentals .................................................................................................... 3

Connect Packets .............................................................................................................. 4 1. Bequeathed Connection....................................................................................... 4 2. Redirected Connection ........................................................................................ 5 3. Refused Connection ............................................................................................ 6

Data Packets .................................................................................................................... 6 Marker Packets................................................................................................................ 7

Understanding the Parts of Oracle Net................................................................................ 8 Oracle Net Categories and Layers................................................................................... 8 Outline of an Oracle Net Session Connection................................................................. 9

Locating the Correct Error Codes in the Trace Output ..................................................... 10 Example Trace File ........................................................................................................... 13

Oracle Net Trace File Header........................................................................................ 13 Trace Configuration Information .............................................................................. 14 Parameter Source Information .................................................................................. 14 Log Configuration Information................................................................................. 15

Initializing Oracle Net, Traversing the Name Space and Authenticating the User....... 16 Initializing Oracle Net............................................................................................... 16 Traversing the Name Space....................................................................................... 16 Authenticating the User............................................................................................. 22

Tracking the Flow of Packets........................................................................................ 25 Security Negotiation.................................................................................................. 30 Two-Task Common................................................................................................... 36 Database Login.......................................................................................................... 42

Summary ........................................................................................................................... 46

Page 3: Analyzing Net trace

Examining Oracle Net Trace Files Page - 2 April 12, 2001

Introduction Oracle Net’s tracing feature is a useful facility for customers, support, and developers to debug their network problems. Many find, the messages in the trace files are cryptic and hard to understand. Customers who do not understand the fundamentals of Oracle Net and need to understand why their client to database communication is failing often read the Oracle Net trace files to no avail. In trying to determine network problems, the analyst runs into another problem: how to understand the cryptic Oracle Net trace file. To better understand and read the trace file, this paper explains the basics of the Oracle Net protocol. The principles presented here apply to reading and understanding client, server, or listener trace files as they are of the same format. These principles also hold if network problem determination needs to be performed on more complex features of the Oracle database (e.g. replication or database links). This paper restricts itself to cover the most complex part of the Oracle Net protocol, the connection process to the database. This is done presenting an example of examining a client trace file up to the point of logging into the database. Why this point in the trace file was chosen is because this is where the majority of the features of Oracle Net unfold. However, the vast majority of the client’s interaction is with the database is transferring data, but to Oracle Net that is just sending and receiving data. Therefore it will be more useful, for Oracle Net trace analysis, to detail the connect process. This paper lightly explains the Oracle Net internals, but is mostly intended to show what is happening in the trace file. In this paper the following topics are covered:

• Understanding the Oracle Net Fundamentals • Understanding the Oracle Net Components • Locating the correct error codes in the trace file • Understanding the Trace File Header Information • Traversing the Service Name Space • Authenticating the User • Tracking the Flow of Packets

Page 4: Analyzing Net trace

Examining Oracle Net Trace Files Page - 3 April 12, 2001

Oracle Net Fundamentals Oracle Net’s main functions are to first establish connections between an Oracle client and an Oracle database and second to transfer data between the two. These functions are performed between a client and a server or, in the case of replication or database links, between two servers. Most of the activity that involves the features of Oracle Net occurs in the before logging into the database, when setting up the connection and session to the Oracle database. Once the connection is established, Oracle Net’s main job is to act as a data courier for the client and server. The Oracle Net protocol1 establishes connections and transfers data via various packets. These packets contain different types of information in them depending on the packet type. Some of the more common packet types are Connect, Accept, Refuse, Redirect, Data, and Marker. Here is a list of the Oracle Net packet types. NSPT stands for Network Session PackeT.

PACKET KEYWORD

PACKET TYPE PACKET NUMBER IN HEX

NSPTCN Connect 0x01 NSPTAC Accept 0x02 NSPTRF Refuse 0x04 NSPTRD Redirect 0x05 NSPTDA Data 0x06 NSPTNL Null - empty data, no flags 0x07 NSPTAB Abort 0x09 NSPTRS Resend packet 0x0B NSPTMK Marker packet 0x0C NSPTAT Attention 0x0D NSPTCNL Control information 0x0E

To initially cover these fundamentals, this paper describes several packet types and groups them in the appropriate roles: connection, transferring data, and interrupting data transfer. What follows is a description of the packets sent and received by each node for particular scenarios.

1 NOTE: Oracle Net resides on the Open Systems Interconnection layers of Session, Presentation, and Application. It is convention to refer to the communication at these layers as to transferring “messages” and not “packets.” However, to keep consistency with other Oracle documentation, these messages are refered to as packets in this paper.

Page 5: Analyzing Net trace

Examining Oracle Net Trace Files Page - 4 April 12, 2001

Connect Packets There are three scenarios that may take place in establishing a connection: Bequeathing, Redirecting, and Refusing. Each of these scenarios requires different packet types to flow between the client and the server.

1. Bequeathed Connection When a database connection is requested by an Oracle client process, such as SQL*Plus, but no service name (or network connection address) is specified, a database is assumed to be running on the same node as the client. A service name is normally specified by the user on the command line, login screen, or by setting the TWO_TASK environment variable. Since no service name was given, and thus no network address is associated with the connect request, it is impossible for Oracle Net to know what network address a listener, dispatcher, or a shadow server process may be listening on, so a brand new dedicated shadow server process is started. The BEQ adapter starts the shadow server process (the BEQ adapter is in the native Oracle client application code). The Oracle client then waits for the shadow process to start and attach itself to the SGA (which is the Oracle Instance defined in the ORACLE_SID environment variable). If the start-up of the shadow process is successful, the BEQ adapter uses inter-process communication beween shadow and client (the actual communication protocol is dependant on the Operating System). The client then sends a Connect packet2 to the shadow process. The shadow process sends back an “accept” packet to the client. Once the connection is established, data can flow between the two processes.

Figure 1: BEQ Connection

2 NOTE: The connect packet when Bequeathing the connection is NOT a packet that traverses a network. The Connect can only be bequeathed when the client and server co-exist on the same node.

Page 6: Analyzing Net trace

Examining Oracle Net Trace Files Page - 5 April 12, 2001

2. Redirected Connection When an Oracle client process requests a connection with a service name specified, access to a remote database is assumed. The client process then looks in the SQLNET.ORA file for the Name Directory Services to be used. In the example presented in this paper, the client queries an Oracle Names Server, followed by an LDAP Server, and finally finds the entry in the local service name file TNSNAMES.ORA. Once the client has the needed name resolution information, it translates the service name into network protocol specific address information. It then performs a network protocol connect to the listener at that network address and sends the Oracle Net connect packet. The listener on the remote database takes in the connect packet, decides if it is to create a dedicated server shadow process or use an existing dispatcher process, and sends that process’ address back to the client. The client then resends the connect request directly to that remote process. Finally, the remote process accepts the connection. Once the connection is established, data can flow between the two nodes. This connection is “redirected” rather then “bequeathed” (regardless if the server process is located on the same or remote node).

Figure 2: Redirected Connection

Page 7: Analyzing Net trace

Examining Oracle Net Trace Files Page - 6 April 12, 2001

3. Refused Connection When the listener on the remote database does not know about the service being requested by the client, or if the service is unavailable, the connection cannot be established and must be refused. A refuse packet is generated and sent by the listener back to the client. The connection to the database will not be established and the reason for the refusal will be contained in the refuse packet.

Figure 3: Refused Connection

Data Packets Data packets will be the most common packets during the interaction with the database. These packets would contain queries and their results, stored procedure calls, and information or messages that make up the bulk of the session with the database. The packet type for a data packet is NSPTDA. NSPTDA packets can be streamed if the network protocol supports this data transfer technique. TCP/IP supports data streaming through Windowing3. Data streaming can be seen in an Oracle Net trace by finding the sections where several NSPTDA packets are being sent with none being received (or the reverse depending on data flow direction). There are some special cases of data packets, two of which are used for Network Security and Dead Connection Detection. Network Security is one special case of data packets occurring during the initial connection. Network Security negotiation consists of two packets exchanged between the client and server processes that determine the type of encryption and data integrity

3 Please see “Internetworking with TCP/IP” by Comer for further information on TCP/IP Windowing.

Page 8: Analyzing Net trace

Examining Oracle Net Trace Files Page - 7 April 12, 2001

algorithms, and authentication method to be used for the session with the database. As part of the Oracle Net protocol, Network Security is always negotiated, even if it is not configured. A second special case of a data packet is for Dead Connection Detection. Thse packets are sent out by the Server to the client to determine if the client is still operational. This case is called Dead Connection Detection. Configured in the SQLNET.ORA file, they are sent out by the server to be responded to by the client at a configurable interval.

Marker Packets The Marker packets are for internal Oracle Net use only. They are used for transferring a Ctrl-C or Out of Band breaks4 from the client to server, or for transferring Oracle Trace5 information to the server.

4 See the Oracle Net manual for an explanation of Out Of Band (OOB) breaks. 5 See the Oracle8i Designing and Tuning for Performance manual for more information on Oracle Trace.

Page 9: Analyzing Net trace

Examining Oracle Net Trace Files Page - 8 April 12, 2001

Understanding the Parts of Oracle Net

Oracle Net Categories and Layers Oracle Net is grouped into three categories, Oracle Net Interface, Transparent Network Substrate (TNS), and the Protocol Adapter. Each of these categories is subdivided into layers, which are covered in more detail below. In each of these layers are several procedures. When called, these procedures are either passed input (parameters) by the caller, or respond with output (messages). When tracing is enabled, it is these procedures that generate the lines in the trace files. Each of the lines has the following structure:

[time stamp] procedure: message or parameters For example:

[12-APR-2001 15:22:40] nricdt: Call made to destination As mentioned above, the “nricdt” is the name of the procedure that generated the message in the trace file. The first 2-3 letters of the procedure name show the component layer of Oracle Net that executed and placed the entry in the trace file. In this example, the “nr” of nricdt is the component layer executed. The component layers are as follows:

Category Layer Description Network Interface NI Operating System dependent Oracle Net Interface TNS NR Network Routing TNS NN Network Names (Oracle Names, LDAP) TNS NS Network Session TNS NA Native Services (Authentication or Security) TNS NL Network Library Protocol Adapter NT Network Transport

Page 10: Analyzing Net trace

Examining Oracle Net Trace Files Page - 9 April 12, 2001

Outline of an Oracle Net Session Connection Here is an outline of the Oracle Net protocol that generates the sample trace file. The client process requests a connection to a database through NI, the initial entry point into Oracle Net.

• NI transfers the request to NR to route the message to the correct destination • NI calls NN to resolve the service name to a network protocol address • NN requests naming services, through NT if needed, and resolves the address • NN passes the information back to NS • NS uses NT initiate a network protocol connection • NS then calls NA for OS authentication, if needed • NA may call NT for a network connection to an Authentication Authority (in this

case it does not) • NA passes control to NS to establish a session connection to the Oracle listener • NS initiates a session connection to the Oracle listener through NT • The Oracle listener acknowledges the availability of the service requested • NT passes the availability information back to NS • NS calls NA to begin the Oracle Advanced Security negotiation • NS issues a few more packets, directly through NT, to initialize its session with

the Oracle database Once all this is done, Oracle Net has completed its functions and the login into the database server takes over and the database session is established. The rest of the conversation between the client and the server, or the server and the server, consists of NI, NS, and NT calling each other sending data back and forth.

Figure 4: Oracle Net Layering

Page 11: Analyzing Net trace

Examining Oracle Net Trace Files Page - 10 April 12, 2001

Locating the Correct Error Codes in the Trace Output It is very important to know what to look for in the trace file when searching for errors. Later in this paper, a trace file is analyzed, identifying a few error examples. Not only is it important to interpret the error codes, but also what is occurring with the Oracle Net procedures prior to the error. It is very important to not only examine the errors but to also examine them in context, as this will lead to a correct resolution quickly. The error information generated is the same across all the trace levels and what process being traced, be it the Oracle Listener, client or server processes. For enabling Oracle Net tracing, please refer to the Oracle Networking Manual. When Oracle Net first encounters an error condition, it calls the procedure ntt2err. This error procedure will output a line reporting the procedure that was executing, the operation it was in, and the resultant error codes were either generated or received. Here is a list of possible operations.

Number Operation Number Operation 1 Connect 9 test 2 Disconnect 10 signal 3 Open 11 write urgent 4 Close 12 read urgent 5 Read 13 read cancel 6 Write 14 read at EOF 7 Control 15 grant socket access 8 Wait

Here is a segment of a trace file to illustrate the error messages that can be generated. [07-APR-2001 14:19:18] nsrdr: entry [07-APR-2001 14:19:18] nsrdr: recving a packet [07-APR-2001 14:19:18] nsprecv: entry [07-APR-2001 14:19:18] nsprecv: reading from transport... [07-APR-2001 14:19:18] nttrd: entry [07-APR-2001 14:19:37] ntt2err: entry [07-APR-2001 14:19:37] ntt2err: soc 160 error - operation=5, ntresnt[0]=517, ntresnt[1]=54, ntresnt[2]=0 [07-APR-2001 14:19:37] ntt2err: exit [07-APR-2001 14:19:37] nttrd: exit [07-APR-2001 14:19:37] nsprecv: transport read error [07-APR-2001 14:19:37] nsprecv: error exit [07-APR-2001 14:19:37] nserror: entry [07-APR-2001 14:19:37] nserror: nsres: id=0, op=68, ns=12547, ns2=12560; nt[0]=517, nt[1]=54, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0 [07-APR-2001 14:19:37] nsrdr: error exit [07-APR-2001 14:19:37] nsdo: nsctxrnk=0

Oracle Net enters into a network transport operation 5 (read) which fails. It passes this condition to the NT error procedure ntt2err. The errors are: ntresnt[0]=517 and ntresnt[0]=54.

NS Packet receive has interpreted this condition as a read error and forwards the conditions to the NS error procedure nserror. NS then translates them to the NS errors: ns=12547 and ns2=12560.

Page 12: Analyzing Net trace

Examining Oracle Net Trace Files Page - 11 April 12, 2001

[07-APR-2001 14:19:37] nsdo: error exit [07-APR-2001 14:19:37] nioqrc: wanted 1 got 0, type 0 [07-APR-2001 14:19:37] nioqper: error from nioqrc [07-APR-2001 14:19:37] nioqper: nr err code: 0 [07-APR-2001 14:19:37] nioqper: ns main err code: 12547 [07-APR-2001 14:19:37] nioqper: ns (2) err code: 12560 [07-APR-2001 14:19:37] nioqper: nt main err code: 517 [07-APR-2001 14:19:37] nioqper: nt (2) err code: 54 [07-APR-2001 14:19:37] nioqper: nt OS err code: 0 [07-APR-2001 14:19:37] nioqer: entry [07-APR-2001 14:19:37] nioqer: incoming err = 12151 [07-APR-2001 14:19:37] nioqce: entry [07-APR-2001 14:19:37] nioqce: exit [07-APR-2001 14:19:37] nioqer: returning err = 3113 [07-APR-2001 14:19:37] nioqer: exit [07-APR-2001 14:19:37] nioqrc: exit

Every time there is an error condition in Oracle Net, the error code is logged in the trace file. As in this example, the same error codes are logged several times as the connection state is moving through the different layers of Oracle Net. Each layer records its own error codes plus the error codes of the layers below it. The Network Interface layer is the layer presenting the final error to the user. This error can be useful in troubleshooting application problems but sometimes only points to a problem needing further investigation. The network session layer controls the connection, but the NS error codes may not be the most helpful in determining the real problem. The more important error messages are the ones at the far right on the lines shown above. They represent the lower network transport layer error codes and are the source of the problem with this connection. The most efficient way to evaluate error codes is to find the lowest level error code logged. To reiterate from the example above: [07-APR-2001 14:19:37] nserror: nsres: id=0, op=68, ns=12547, ns2=12560; nt[0]=517, nt[1]=54, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0

Is interpreted as: nserror: nsres: id=0, op=68,

ns=12547, TNS-12547 TNS:lost contact ns2=12560; TNS-12560 TNS:protocol adapter error nt[0]=517, TNS-517 TNS: Lost contact nt[1]=54, Operating System protocol error: 54 nt[2]=0; Operating System error: none generated ora[0]=0, ora[1]=0, ora[2]=0 NS global descriptors: none generated

Here the Operating System error 54 is the actual cause of the NI error ORA-3113 that was sent to the client process. To locate OS protocol in UNIX, examine the file:

/usr/include/sys/errno.h

NS passes these error conditions to NI to interprets them as the errors: err = 12151 and err = 3113.

Page 13: Analyzing Net trace

Examining Oracle Net Trace Files Page - 12 April 12, 2001

This trace was generated on a Microsoft NT 4.0 system so this is a WINSOCK error 54:

WSAECONNRESET 54 10054 Connection reset by peer. An existing connection was forcibly closed by the remote host. This normally results if the peer application on the remote host is suddenly stopped, the host is rebooted, or the remote host used a "hard close" on the remote socket. This error may also result if a connection was broken due to keep-alive activity detecting a failure while one or more operations are in progress. Operations that were in progress fail with WSAENETRESET. Subsequent operations fail with WSAECONNRESET.

Now the nt[0]=517 is the error code TNS interpreted from the network protocol error 54. This can be found using the Oracle UNIX error tool “oerr” or by looking up the error code in the Oracle Error Messages manual (oerr is not available in Micorosft’s NT). To use “oerr” to discover more information about Oracle Net return codes, enter:

oerr tns error_number

In this example “oerr tns 517” would return:

00517, 00000, "Lost contact" // *Cause: Partner has unexpectedly gone away. // *Action: Investigate partner application for abnormal termination.

As it can be seen, a network protocol reset would result in the client having “Lost contact” with the server. The explanation of the NS errors, ns2=12569 and ns=12547 can also be found using the “oerr” tool or in the Oracle Error Messages manual. These would be:

12596, 00000, "TNS: internal inconsistency" // *Cause: TNS has detected an internal inconsistency. // *Action: Not normally visible to the user. For further details, turn // on tracing and re-execute the operation and contact Oracle Customer // Support.

The “internal inconsistency” would be that there was no log off from the database before the communication terminated.

12547, 00000, "TNS:lost contact" // *Cause: Partner has unexpectedly gone away, usually during process // startup. // *Action: Investigate partner application for abnormal termination. On an // Interchange, this can happen if the machine is overloaded.

And, again, the partner had “lost contact.”

Page 14: Analyzing Net trace

Examining Oracle Net Trace Files Page - 13 April 12, 2001

Example Trace File

Oracle Net Trace File Header The Oracle Net trace file header is created when first connecting to a database if tracing is initialized. The information in the header tells the location of the tracing information file and the detail level of the trace. It then displays the locatin of the Oracle Net configuration files being used and the parameters read from these files. Finally, it displays the location of the logging information is being placed and the logging detail level. Oracle Net logging is not covered in this paper. [12-APR-2001 15:22:37] --- TRACE CONFIGURATION INFORMATION FOLLOWS --- [12-APR-2001 15:22:37] New trace stream is e:\oracle\ora81\network\trace\cli_326_1.trc [12-APR-2001 15:22:37] New trace level is 16 [12-APR-2001 15:22:37] --- TRACE CONFIGURATION INFORMATION ENDS --- [12-APR-2001 15:22:37] --- PARAMETER SOURCE INFORMATION FOLLOWS --- [12-APR-2001 15:22:37] Attempted load of system pfile source E:\oracle\ora81\network\admin\sqlnet.ora [12-APR-2001 15:22:37] Parameter source loaded successfully [12-APR-2001 15:22:37] [12-APR-2001 15:22:37] Attempted load of local pfile source E:\Oracle\Ora81\BIN\sqlnet.ora [12-APR-2001 15:22:37] Parameter source was not loaded [12-APR-2001 15:22:37] [12-APR-2001 15:22:37] -> PARAMETER TABLE LOAD RESULTS FOLLOW <- [12-APR-2001 15:22:37] Successful parameter table load [12-APR-2001 15:22:37] -> PARAMETER TABLE HAS THE FOLLOWING CONTENTS <- [12-APR-2001 15:22:37] SQLNET.EXPIRE_TIME = 1 [12-APR-2001 15:22:37] TRACE_LEVEL_SERVER = OFF [12-APR-2001 15:22:37] TRACE_LEVEL_CLIENT = 16 [12-APR-2001 15:22:37] NAMES.PREFERRED_SERVERS = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = roseate.us.oracle.com)(PORT = 1400))) [12-APR-2001 15:22:37] NAMES.DIRECTORY_PATH = (ONAMES, LDAP, TNSNAMES) [12-APR-2001 15:22:37] SQLNET.CRYPTO_SEED = 4fhfguweotcadsfdsafjkdsfqp5f201p45mxskdlfdasf [12-APR-2001 15:22:37] TRACE_UNIQUE_CLIENT = ON [12-APR-2001 15:22:37] TRACE_FILE_SERVER = serv [12-APR-2001 15:22:37] SQLNET.AUTHENTICATION_SERVICES = (NONE) [12-APR-2001 15:22:37] TRACE_DIRECTORY_CLIENT = e:\oracle\ora81\network\trace [12-APR-2001 15:22:37] NAMES.DEFAULT_DOMAIN = us.oracle.com [12-APR-2001 15:22:37] TRACE_TIMESTAMP_CLIENT = ON [12-APR-2001 15:22:37] TRACE_FILE_CLIENT = cli [12-APR-2001 15:22:37] TRACE_DIRECTORY_SERVER = e:\oracle\ora81\network\trace [12-APR-2001 15:22:37] --- PARAMETER SOURCE INFORMATION ENDS --- [12-APR-2001 15:22:37] --- LOG CONFIGURATION INFORMATION FOLLOWS --- [12-APR-2001 15:22:37] Log stream will be "E:\Oracle\Ora81\BIN\sqlnet.log" [12-APR-2001 15:22:37] Log stream validation not requested [12-APR-2001 15:22:37] --- LOG CONFIGURATION INFORMATION ENDS ---

Example 1: Trace File Header

Page 15: Analyzing Net trace

Examining Oracle Net Trace Files Page - 14 April 12, 2001

Trace Configuration Information

The Trace Configuration Information contains the path and name of the trace file created for this particular process and the trace level used. The trace header records exactly what level of information is being collected. Trace levels can be set in either the system or user SQLNET.ORA files on the client and server or in the LISTENER.ORA file on the server. The SQLNET.ORA file turns on/off tracing for the client or server, while the LISTENER.ORA turns on/off tracing for the Oracle listener. Valid settings are:

Setting using a word Setting using a number OFF 0 USER 4 ADMIN 10 SUPPORT 16

The amount of information Oracle Net will place in the trace file increases as the values of the trace level increase. These levels are set through the configuration editor, the Oracle Net Manger, the Net8 Assistant, or by hand-editing the appropriate configuration files. Performance degradation will be encountered when tracing is enabled, so it is important to turn tracing off when debugging is completed as the trace files continue to grow, and take up storage.

Parameter Source Information The file or files read and used by Oracle Net for configuration are listed under the heading of Parameter Source Information. This information is relevant because more then one configuration file can be used. Two types of SQLNET.ORA configuration files can be located on the client or server: system and user6. The system SQLNET.ORA file is located in either ORACLE_HOME/network/admin or in the location specified by the environment variable TNS_ADMIN. The system file is to be used by more then one client. This provides the administrator with the ability to configure global parameters while allowing the changing of parameters for a single client without interfering with all others. The client is the sole user of the user SQLNET.ORA file and these parameters will override the system file’s parameters. In Example 1, the system SQLNET.ORA file is loaded successfully, but the user file is not loaded because it doesn’t exist on the client’s system.

6 NOTE: If it is not known where to locate the user file, examine the Parameter Source Information to find out which directory the client or server is expecting it to reside in. Oracle Net Manager does not create this file nor is its location modifiable.

Page 16: Analyzing Net trace

Examining Oracle Net Trace Files Page - 15 April 12, 2001

For the listener, only one file is used for configuration information: LISTENER.ORA. The LISTENER.ORA file is located in $ORACLE_HOME/network/admin or in the location specified by the environment variable TNS_ADMIN. The parameters read should coincide with the ones originally intended. If not, then the either the wrong parameter files are being modified, or this may be the source of the problem being diagnosed.

Log Configuration Information The Log Configuration Information contains the path and filename of the Oracle Net log file. The log file contains the final error messages for the connection, but may not contain the cause of the error message. With logging enabled, the error will first appear there. If there is question as to why the error in the log file is being generated, enable Oracle Net tracing and examine the resultant trace file for detailed information about the error. Logging, when enabled, will only create a log file when Oracle Net detects an error.

Page 17: Analyzing Net trace

Examining Oracle Net Trace Files Page - 16 April 12, 2001

Initializing Oracle Net, Traversing the Name Space and Authenticating the User

Initializing Oracle Net Before the connection request occurs, Oracle Net performs several procedures to set up its running environment. This is the most work done by the Oracle Net features; so illustrating the diagnosis of problems in this area will relay the needed knowledge of just what is being done. A simple outline of the tasks needed to get to the database login is as follows:

• Start Oracle Net, choose the naming method, and resolve service name to a protocol address

• Authenticate the user through by an external means (authentication Authority). • Initialize the Network Session, open the network protocol, and connect to the

database • Negotiate Encryption and Integrity algorithms, Operating Systems, and Two Task

Common character set • Log into the database

Traversing the Name Space. The Network Interface initializes and then queries NR to see if an Oracle Net router is to be used. This router is Oracle Connection Manager, which is an OSI Session Layer routing device. Connection Manager has the ability to gateway database communication between two different protocols, like TCP and SPX. In earlier versions of Oracle Net, this ability was configured at this point. However, being a gateway between two protocols is not configured this way anymore, but the procedures are left for backward compatibility reasons. NN then takes over to search down the name space directory path for which kind of naming directory service is to be used. The directory search path is set in the SQLNET.ORA file by the parameter NAMES.DIRECTORY_PATH. Be careful about setting the order of the entries in this parameter because NN will search the exact order from left to right. For this trace file the parameter is set to:

NAMES.DIRECTORY_PATH = (ONAMES, LDAP, TNSNAMES) Note from the start of the trace section to when it has been able to resolve the service name and shut down NN. The trace starts at 15:22:37 and shuts down NN at 15:22:40. Further down this trace, it is pointed out where the delay is. If the problem was too long connection times, using time stamping will point out where any delay, like this one, can be found.

Page 18: Analyzing Net trace

Examining Oracle Net Trace Files Page - 17 April 12, 2001

This is the beginning of the sample trace file. The description of what is occurring in the file is documented on the left side of the page. The format of the file has been altered slightly in order to fit on a page that includes those descriptions.

Example 2: Sample Trace File

[12-APR-2001 15:22:37] nigini: entry [12-APR-2001 15:22:37] nigini: Count in NI global area now: 1 [12-APR-2001 15:22:37] nigini: Count in NI global area now: 1 [12-APR-2001 15:22:37] nrigbi: entry [12-APR-2001 15:22:37] nrigbni: entry [12-APR-2001 15:22:37] nrigbni: Unable to get data from navigation file tnsnav.ora [12-APR-2001 15:22:37] nrigbni: exit [12-APR-2001 15:22:37] nrigbi: exit [12-APR-2001 15:22:37] nigini: exit [12-APR-2001 15:22:37] niqname: Using nnfsn2a() to build connect descriptor for (possibly remote) database. [12-APR-2001 15:22:37] nnfgiinit: entry [12-APR-2001 15:22:37] nnftboot: entry [12-APR-2001 15:22:37] nnftboot: exit [12-APR-2001 15:22:37] nnfoboot: entry [12-APR-2001 15:22:37] nnfoboot: exit [12-APR-2001 15:22:37] nnfoboot: entry [12-APR-2001 15:22:37] nnfoboot: exit [12-APR-2001 15:22:37] nnfhboot: entry [12-APR-2001 15:22:37] nnfhboot: exit [12-APR-2001 15:22:37] nnfnboot: entry [12-APR-2001 15:22:37] nnfnboot: exit [12-APR-2001 15:22:37] nnfnboot: entry [12-APR-2001 15:22:37] nnfnboot: exit [12-APR-2001 15:22:37] nnflcls: entry [12-APR-2001 15:22:37] nnflcls: exit [12-APR-2001 15:22:37] nncpmlf_make_local_addrfile: construction of local names file failed [12-APR-2001 15:22:37] nncpmsf_make_sys_addrfile: system names file is E:\oracle\ora81\network\admin\tnsnames.ora [12-APR-2001 15:22:37] nncpcin_maybe_init: first request sent to name server will have ID 33966 [12-APR-2001 15:22:37] nncpcin_maybe_init: initial retry timeout for all name servers is 1500 csecs [12-APR-2001 15:22:37] nncpcin_maybe_init: max request retries per name server is 1 [12-APR-2001 15:22:37] nngsnad_new_stream_addr: "(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))" [12-APR-2001 15:22:37] nngsini_init_streams: initializing stream subsystem, cache size is 10 [12-APR-2001 15:22:37] nngtini_init_msg: initializing PDU subsystem, initial pool size is 2 [12-APR-2001 15:22:37] nncpcin_maybe_init: default name server domain is us.oracle.com [12-APR-2001 15:22:37] nnfun2a: entry [12-APR-2001 15:22:37] nlolgobj: entry [12-APR-2001 15:22:37] nnfgrne: entry [12-APR-2001 15:22:37] nnfgrne: Installing read path [12-APR-2001 15:22:37] nnfgsrsp: entry [12-APR-2001 15:22:37] nnfgsrsp: Obtaining path parameter from names.directory_path or native_names.directory_path [12-APR-2001 15:22:37] nnfgsrdp: entry [12-APR-2001 15:22:37] nnfgsrdp: Setting path: [12-APR-2001 15:22:37] nnfgsrdp: checking element ONAMES [12-APR-2001 15:22:37] nnfgsrdp: checking element LDAP [12-APR-2001 15:22:37] nnfgsrdp: checking element TNSNAMES [12-APR-2001 15:22:37] nnfgsrdp: Path set [12-APR-2001 15:22:37] nnfgrne: Going though read path adapters [12-APR-2001 15:22:37] nnfgrne: Switching to ONAMES adapter [12-APR-2001 15:22:37] nnfgrne: Original name: v817 [12-APR-2001 15:22:37] nngtnms_new_msg: new message, ID 33967, type 100 [12-APR-2001 15:22:37] nngtnms_new_msg: initial message pool block, size 2

The Names Directory Path is read and constructed the lookup order.

Using Oracle Names

Connection Navigation configuration

Page 19: Analyzing Net trace

Examining Oracle Net Trace Files Page - 18 April 12, 2001

[12-APR-2001 15:22:37] nncpsrq_send_request: attempt 1, name server with metric 0 at (ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))... [12-APR-2001 15:22:37] nngsget_get_stream: looking for "(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))" [12-APR-2001 15:22:37] nngsget_get_stream: cache miss, opening new stream [12-APR-2001 15:22:37] nngsnad_new_stream_addr: "(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))" [12-APR-2001 15:22:37] nngsget_get_stream: no caller address will be sent to callee [12-APR-2001 15:22:37] nricall: entry [12-APR-2001 15:22:37] nric2a: entry [12-APR-2001 15:22:37] nric2a: Getting local community information [12-APR-2001 15:22:37] nriglp: entry [12-APR-2001 15:22:37] nriglp: Looking for local addresses setup by nrigla [12-APR-2001 15:22:37] nriglp: No addresses in the preferred address list [12-APR-2001 15:22:37] nriglp: exit [12-APR-2001 15:22:37] nric2a: TNSNAV.ORA is not present. No local communities entry. [12-APR-2001 15:22:37] nrigla: entry [12-APR-2001 15:22:37] nrigla: Getting local address information [12-APR-2001 15:22:37] nrigla: Simple address... [12-APR-2001 15:22:37] nrigla: No community component so just use straight address [12-APR-2001 15:22:37] nrigla: exit [12-APR-2001 15:22:37] nridst: entry [12-APR-2001 15:22:37] nridst: Resolving address to use to call destination or next hop [12-APR-2001 15:22:37] nridst: Found destination address [12-APR-2001 15:22:37] nridst: Local address [12-APR-2001 15:22:37] nridst: Local destination community found [12-APR-2001 15:22:37] nridst: exit [12-APR-2001 15:22:37] nric2a: This is a local community access [12-APR-2001 15:22:37] nric2a: exit [12-APR-2001 15:22:37] nricall: Got routable address information. [12-APR-2001 15:22:37] nricall: Making call with following address information: (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))). [12-APR-2001 15:22:37] nricdt: entry [12-APR-2001 15:22:37] nricdt: Calling with outgoing connect data: (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))). [12-APR-2001 15:22:37] nscall: entry [12-APR-2001 15:22:37] nsmal: entry [12-APR-2001 15:22:37] nsmal: 140 bytes at 0x62cbd0 [12-APR-2001 15:22:37] nsmal: normal exit [12-APR-2001 15:22:37] nscall: connecting... [12-APR-2001 15:22:37] nsc2addr: entry [12-APR-2001 15:22:37] nttbnd2addr: entry [12-APR-2001 15:22:37] nttbnd2addr: port resolved to 1400 [12-APR-2001 15:22:37] nttbnd2addr: looking up IP addr for host: roseate.us.oracle.com [12-APR-2001 15:22:37] nttbnd2addr: exit [12-APR-2001 15:22:37] nsc2addr: normal exit [12-APR-2001 15:22:37] nsopen: entry [12-APR-2001 15:22:37] nsmal: entry [12-APR-2001 15:22:37] nsmal: 420 bytes at 0x62cc60 [12-APR-2001 15:22:37] nsmal: normal exit [12-APR-2001 15:22:37] nsopenmplx: entry [12-APR-2001 15:22:37] nsmal: entry [12-APR-2001 15:22:37] nsmal: 1712 bytes at 0x1a2ff98 [12-APR-2001 15:22:37] nsmal: normal exit [12-APR-2001 15:22:37] nsopenmplx: normal exit [12-APR-2001 15:22:37] nsopen: opening transport... [12-APR-2001 15:22:37] nttcon: entry [12-APR-2001 15:22:37] nttcon: toc = 1 [12-APR-2001 15:22:37] nttcnp: entry [12-APR-2001 15:22:37] ntvlin: entry [12-APR-2001 15:22:37] ntvllt: entry [12-APR-2001 15:22:37] ntvllt: No PROTOCOL.ORA file is found [12-APR-2001 15:22:37] ntvllt: exit [12-APR-2001 15:22:37] ntvlin: exit [12-APR-2001 15:22:37] nttcnp: Validnode Table IN use; err 0x0 [12-APR-2001 15:22:37] nttcnp: creating a socket. [12-APR-2001 15:22:37] nttcnp: exit [12-APR-2001 15:22:37] nttcni: entry [12-APR-2001 15:22:37] nttcni: trying to connect to socket 156. [12-APR-2001 15:22:39] ntt2err: entry

Here is where the delay is. When the client was trying to connect to socket 156, it took a little under two seconds for TCP/IP to timeout (a typical interval for TCP/IP). If the user were reporting slow connections to the database, this would be the cause.

Here NR is going through NS to get to NT to resolve the hostname of the Names Server.

Page 20: Analyzing Net trace

Examining Oracle Net Trace Files Page - 19 April 12, 2001

[12-APR-2001 15:22:39] ntt2err: soc 156 error - peration=1, ntresnt[0]=511, ntresnt[1]=61, ntresnt[2]=0 [12-APR-2001 15:22:39] ntt2err: exit [12-APR-2001 15:22:39] nttcni: exit [12-APR-2001 15:22:39] nttcon: exit [12-APR-2001 15:22:39] nserror: entry [12-APR-2001 15:22:39] nserror: nsres: id=0, op=65, ns=12541, ns2=12560; nt[0]=511, nt[1]=61, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0 [12-APR-2001 15:22:39] nsopen: unable to open transport [12-APR-2001 15:22:39] nsbfr: entry [12-APR-2001 15:22:39] nsbfr: normal exit [12-APR-2001 15:22:39] nsmfr: entry [12-APR-2001 15:22:39] nsmfr: 1712 bytes at 0x1a2ff98 [12-APR-2001 15:22:39] nsmfr: normal exit [12-APR-2001 15:22:39] nsmfr: entry [12-APR-2001 15:22:39] nsmfr: 420 bytes at 0x62cc60 [12-APR-2001 15:22:39] nsmfr: normal exit [12-APR-2001 15:22:39] nsopen: error exit [12-APR-2001 15:22:39] nsmfr: entry [12-APR-2001 15:22:39] nsmfr: 140 bytes at 0x62cbd0 [12-APR-2001 15:22:39] nsmfr: normal exit [12-APR-2001 15:22:39] nscall: error exit [12-APR-2001 15:22:39] nricdt: Call failed. [12-APR-2001 15:22:39] nricfg: entry [12-APR-2001 15:22:39] nricfg: exit [12-APR-2001 15:22:39] nricdt: Call made to destination. [12-APR-2001 15:22:39] nricdt: exit [12-APR-2001 15:22:39] nricall: Failed to copy originating community name value binding. [12-APR-2001 15:22:39] nricall: Exiting NRICALL with following termination result: -1. [12-APR-2001 15:22:39] nricall: exit [12-APR-2001 15:22:39] nngscls_close_stream: UID 1 not established, ignored [12-APR-2001 15:22:39] nngsfad_free_stream_addr: "(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))" [12-APR-2001 15:22:39] nngsget_get_stream: open failure, error stack follows [12-APR-2001 15:22:39] nncpsrq_send_request: name server request failed, trying next server [12-APR-2001 15:22:39] nngtrms_release_msg: entry [12-APR-2001 15:22:39] nngtrms_release_msg: Message ID 33967 [12-APR-2001 15:22:39] nngtrms_release_msg: msg pointer = 0x62c50c [12-APR-2001 15:22:39] nngtrms_release_msg: Message is a request: Not destroying call ctx [12-APR-2001 15:22:39] nngtrlt_rpc_list_trace: ========== Call context list follows: =========== [12-APR-2001 15:22:39] nngtrlt_rpc_list_trace: element msg id msg ptr call ctx svc ctx [12-APR-2001 15:22:39] nngtrlt_rpc_list_trace: ========== End call context list ================ [12-APR-2001 15:22:39] nngtrms_release_msg: exit [12-APR-2001 15:22:39] nnfgrne: Query unsuccessful, skipping to next adapter [12-APR-2001 15:22:39] nnfgrne: Switching to LDAP adapter [12-APR-2001 15:22:39] nnflrne: entry [12-APR-2001 15:22:39] nnflcgc: entry [12-APR-2001 15:22:39] nnflobc: entry [12-APR-2001 15:22:39] nnflobc: initializing SNNFL [12-APR-2001 15:22:39] nnflobc: initialized new connection ctx 62c640 [12-APR-2001 15:22:39] nnflgcp: entry [12-APR-2001 15:22:39] nnflgcp: exit [12-APR-2001 15:22:39] nnflobc: directory server type is 1 [12-APR-2001 15:22:39] nnflgcp: entry [12-APR-2001 15:22:39] nnflgcp: exit [12-APR-2001 15:22:39] nnflgcp: entry [12-APR-2001 15:22:39] nnflgcp: exit [12-APR-2001 15:22:39] nnflrlc: entry [12-APR-2001 15:22:39] nnfldlc: entry [12-APR-2001 15:22:39] nnfldlc: exit [12-APR-2001 15:22:39] nnflpsl: entry [12-APR-2001 15:22:39] nnflgcp: entry [12-APR-2001 15:22:39] nnflgcp: exit [12-APR-2001 15:22:39] nnflpsl: exit

The OS returned an error 61. The client was a Microsoft NT 4.0 client and is using the WINSOCK interface to TCP/IP. WINSOCK error 61 translates to: WSAECONNREFUSED 61 10061 Connection refused. No connection could be made because the target machine actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host. There was no Oracle Names server at this address, so TCP refused the connection request.

Using the LDAP adapter.

If there were more Oracle Names servers, they would be tried here.

Page 21: Analyzing Net trace

Examining Oracle Net Trace Files Page - 20 April 12, 2001

[12-APR-2001 15:22:40] nnflilc: entry [12-APR-2001 15:22:40] nnflilc: Opening sync conn to roseate.us.oracle.com:389 [12-APR-2001 15:22:40] nnflalc: entry [12-APR-2001 15:22:40] nnflalc: bind call returns 0 [12-APR-2001 15:22:40] nnflalc: exit [12-APR-2001 15:22:40] nnflilc: exit [12-APR-2001 15:22:40] nnflrlc: exit [12-APR-2001 15:22:40] nnflobc: exit [12-APR-2001 15:22:40] nnflcgc: exit [12-APR-2001 15:22:40] nnfln2x: entry [12-APR-2001 15:22:40] nnflgcp: entry [12-APR-2001 15:22:40] nnflgcp: exit [12-APR-2001 15:22:40] nnfln2x: exit [12-APR-2001 15:22:40] nnflrne: Quering the directory for distinguished name cn=kar,cn=OracleContext,cn=oracle internet directory [12-APR-2001 15:22:40] nnflqbf: entry [12-APR-2001 15:22:40] nnflqbf: exit [12-APR-2001 15:22:40] nnflrne: exit [12-APR-2001 15:22:40] nnfgrne: Query unsuccessful, skipping to next adapter [12-APR-2001 15:22:40] nnfgrne: Switching to TNSNAMES adapter [12-APR-2001 15:22:40] nnfgrne: Original name: v817 [12-APR-2001 15:22:40] nnftqnm: entry [12-APR-2001 15:22:40] nnfcagmd: entry [12-APR-2001 15:22:40] nnfcagmd: Attempting to find metadata for type a.smd [12-APR-2001 15:22:40] nnfcagmd: Attribute name a.smd is a predefined meta type, syntax is 4. [12-APR-2001 15:22:40] nnfcagmd: exit [12-APR-2001 15:22:40] nnfotran: Checking local tnsnames.ora file [12-APR-2001 15:22:40] nnfotran: Checking local tnsnames.ora file [12-APR-2001 15:22:40] nncpldf_load_addrfile: initial load of names file E:\oracle\ora81\network\admin\tnsnames.ora [12-APR-2001 15:22:40] nncpldf_load_addrfile: success [12-APR-2001 15:22:40] --- E:\oracle\ora81\network\admin\tnsnames.ora TABLE HAS THE FOLLOWING CONTENTS --- [12-APR-2001 15:22:40] EXTPROC_CONNECTION_DATA.US.ORACLE.COM = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC0))) (CONNECT_DATA = (SID = PLSExtProc) (PRESENTATION = RO))) [12-APR-2001 15:22:40] V817.US.ORACLE.COM = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = abadah)(PORT = 1521))) (CONNECT_DATA = (SERVER = DEDICATED)(SID = V817))) [12-APR-2001 15:22:40] --- END E:\oracle\ora81\network\admin\tnsnames.ora TABLE --- [12-APR-2001 15:22:40] nnftqnm: Using tnsnames.ora address (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = abadah)(PORT = 1521))) (CONNECT_DATA = (SERVER = DEDICATED)(SID = V817))) for name v817.us.oracle.com [12-APR-2001 15:22:40] nnfcraa: entry [12-APR-2001 15:22:40] nnfgrne: Name successfully queried [12-APR-2001 15:22:40] nnfgrne: Obtaining answer records for v817 [12-APR-2001 15:22:40] nnftans: entry [12-APR-2001 15:22:40] nnfcran: entry [12-APR-2001 15:22:40] nnfcran: 64 rrs requested, 1 remaining, 1 total [12-APR-2001 15:22:40] nnfcran: exit [12-APR-2001 15:22:40] nnfgrne: exit [12-APR-2001 15:22:40] nlolgserv: entry [12-APR-2001 15:22:40] nnfggav: entry [12-APR-2001 15:22:40] nnfggav: exit [12-APR-2001 15:22:40] nnfgfrm: entry [12-APR-2001 15:22:40] nnfgfrm: exit [12-APR-2001 15:22:40] nlolgserv: exit [12-APR-2001 15:22:40] nlolgobj: exit [12-APR-2001 15:22:40] nlolfmem: entry [12-APR-2001 15:22:40] nlolfmem: exit [12-APR-2001 15:22:40] nnfgdei: entry [12-APR-2001 15:22:40] nnfndei: entry [12-APR-2001 15:22:40] nnfndei: exit [12-APR-2001 15:22:40] nnfndei: entry [12-APR-2001 15:22:40] nnfndei: exit [12-APR-2001 15:22:40] nnfldei: entry [12-APR-2001 15:22:40] nnflcls: entry [12-APR-2001 15:22:40] nnflcls: exit

Using the local TNSNAMES.ORA file.

There was no error message produced by the failure to retrieve the service name. If the client was unable to resolve the service name, the query was unccessful. Oracle Net could not pass back the information needed by NN.

NN has successfully found the service name and shuts itself down.

The service name was found and

translated into a protocol specific

address.

Page 22: Analyzing Net trace

Examining Oracle Net Trace Files Page - 21 April 12, 2001

[12-APR-2001 15:22:40] nnfldei: exit [12-APR-2001 15:22:40] nngsfad_free_stream_addr: "(ADDRESS=(PROTOCOL=TCP)(HOST=roseate.us.oracle.com)(PORT=1400))" [12-APR-2001 15:22:40] nngtdei_deinit_msg: free message pool block [12-APR-2001 15:22:40] nngtfms_free_msg: message ID 33967 [12-APR-2001 15:22:40] nngtfms_free_msg: message was a request [12-APR-2001 15:22:40] nngtfms_free_msg: message free, type 100 [12-APR-2001 15:22:40] nngtfoa_free_objarr: free message object array [12-APR-2001 15:22:40] nngtfoa_free_objarr: free message object array [12-APR-2001 15:22:40] nngtfoa_free_objarr: free message object array [12-APR-2001 15:22:40] nngtfoa_free_objarr: free message object array [12-APR-2001 15:22:40] nngtfmt_free_msg_type: type-specific message free, type 100 [12-APR-2001 15:22:40] nngtfoa_free_objarr: free message object array [12-APR-2001 15:22:40] nngtfms_free_msg: message ID 0 [12-APR-2001 15:22:40] nngtfms_free_msg: message was a response [12-APR-2001 15:22:40] nngtfms_free_msg: message free, type 0 [12-APR-2001 15:22:40] nngsdei_deinit_streams: deinit [12-APR-2001 15:22:40] nngscls_close_stream: UID 1 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nngscls_close_stream: UID 0 not established, ignored [12-APR-2001 15:22:40] nsbfrfl: entry [12-APR-2001 15:22:40] nsbfrfl: normal exit [12-APR-2001 15:22:40] nnfgdei: exit

From the start of this process, it took around three seconds to resolve the service name. Listing TNSNAMES first in the NAMES.DIRECTORY_PATH configuration line would speed up this service name resolution because it was where the service name was defined. The proper setting of this parameter will depend on the Oracle Net environment. Many connection problems can be resolved by the discovery of improper navigation through the name space. The trace shows what the service name has translated to. If this is not the correct translation, it will be easy to find out what directory service is configured incorrectly. [12-APR-2001 15:22:40] niotns: entry [12-APR-2001 15:22:40] niotns: niotns: setting up interrupt handler... [12-APR-2001 15:22:40] niotns: Not trying to enable dead connection detection. [12-APR-2001 15:22:40] niotns: Calling address: (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=abadah)(PORT=1521))) (CONNECT_DATA=(SERVICE_NAME=V817.us.oracle.com) (CID=(PROGRAM=E:\Oracle\Ora81\BIN\SQLPLUSW.EXE)(HOST=KAREARDO-PC)(USER=kareardo)))) [12-APR-2001 15:22:40] nscall: entry [12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 140 bytes at 0x62af00 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nscall: connecting... [12-APR-2001 15:22:40] nladini: entry [12-APR-2001 15:22:40] nladini: exit [12-APR-2001 15:22:40] nladget: entry [12-APR-2001 15:22:40] nladget: exit [12-APR-2001 15:22:40] nsc2addr: entry [12-APR-2001 15:22:40] nttbnd2addr: entry [12-APR-2001 15:22:40] nttbnd2addr: port resolved to 1521 [12-APR-2001 15:22:40] nttbnd2addr: looking up IP addr for host: abadah [12-APR-2001 15:22:40] nttbnd2addr: exit [12-APR-2001 15:22:40] nsc2addr: normal exit [12-APR-2001 15:22:40] nsopen: entry

NI signals NS, which in turn signals NT to resolve the TCP/IP hostname of the destination database host and establish a network connection to the host.

Converting TNSNAMES.ORA entry to Protocol Address.

Page 23: Analyzing Net trace

Examining Oracle Net Trace Files Page - 22 April 12, 2001

[12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 420 bytes at 0x62ba30 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nsopenmplx: entry [12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 1712 bytes at 0x19ddd50 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nsopenmplx: normal exit [12-APR-2001 15:22:40] nsopen: opening transport... [12-APR-2001 15:22:40] nttcon: entry [12-APR-2001 15:22:40] nttcon: toc = 1 [12-APR-2001 15:22:40] nttcnp: entry [12-APR-2001 15:22:40] ntvlin: entry [12-APR-2001 15:22:40] ntvllt: entry [12-APR-2001 15:22:40] ntvllt: No PROTOCOL.ORA file is found [12-APR-2001 15:22:40] ntvllt: exit [12-APR-2001 15:22:40] ntvlin: exit [12-APR-2001 15:22:40] nttcnp: Validnode Table IN use; err 0x0 [12-APR-2001 15:22:40] nttcnp: creating a socket. [12-APR-2001 15:22:40] nttcnp: exit [12-APR-2001 15:22:40] nttcni: entry [12-APR-2001 15:22:40] nttcni: trying to connect to socket 156. [12-APR-2001 15:22:40] nttcni: exit [12-APR-2001 15:22:40] nttcon: NT layer TCP/IP connection has been established. [12-APR-2001 15:22:40] nttcon: set TCP_NODELAY on 156 [12-APR-2001 15:22:40] nttcon: exit [12-APR-2001 15:22:40] nsopen: transport is open

Authenticating the User [12-APR-2001 15:22:40] nsnainit: entry [12-APR-2001 15:22:40] nsnainit: call [12-APR-2001 15:22:40] nsnadct: entry [12-APR-2001 15:22:40] nsnadct: normal exit [12-APR-2001 15:22:40] nsnasvnainfo: entry [12-APR-2001 15:22:40] nsnasvnainfo: normal exit [12-APR-2001 15:22:40] nainit: entry [12-APR-2001 15:22:40] nagblini: entry [12-APR-2001 15:22:40] nau_gin: entry [12-APR-2001 15:22:40] nau_gparams: entry [12-APR-2001 15:22:40] nam_gbp: Reading parameter "sqlnet.authentication_required" from parameter file [12-APR-2001 15:22:40] nam_gbp: Parameter not found [12-APR-2001 15:22:40] nau_gparams: Using default value "FALSE" [12-APR-2001 15:22:40] nau_gslf: entry [12-APR-2001 15:22:40] nam_gic: entry [12-APR-2001 15:22:40] nam_gic: Counting # of items in "sqlnet.authentication_services" parameter [12-APR-2001 15:22:40] nam_gic: Found 1 items [12-APR-2001 15:22:40] nam_gic: exit [12-APR-2001 15:22:40] nam_gnsp: Reading parameter "sqlnet.authentication_services" from parameter file [12-APR-2001 15:22:40] nam_gnsp: Found value "NONE" [12-APR-2001 15:22:40] nauss_set_state: entry [12-APR-2001 15:22:40] nauss_set_state: exit [12-APR-2001 15:22:40] nau_gslf: exit [12-APR-2001 15:22:40] nau_gparams: exit [12-APR-2001 15:22:40] nau_gin: exit [12-APR-2001 15:22:40] nagblini: exit [12-APR-2001 15:22:40] na_saveprot: entry [12-APR-2001 15:22:40] na_saveprot: exit [12-APR-2001 15:22:40] nacomin: entry [12-APR-2001 15:22:40] nas_init: entry [12-APR-2001 15:22:40] nas_init: exit [12-APR-2001 15:22:40] nau_ini: entry [12-APR-2001 15:22:40] naugcp_get_connect_parameters: entry [12-APR-2001 15:22:40] nauss_set_state: entry [12-APR-2001 15:22:40] nauss_set_state: exit

Opening TCP/IP Network Protocol

See the Oracle Net manual for more information on this file and its use.

Oracle Net checks for what type of authentication services are configured, in this case, none.

If Oracle Net needs to authenticate the user, it performs this task now.

Setting up the Network Native Services (Security).

Page 24: Analyzing Net trace

Examining Oracle Net Trace Files Page - 23 April 12, 2001

[12-APR-2001 15:22:40] naugcp_get_connect_parameters: exit [12-APR-2001 15:22:40] nau_sini: entry [12-APR-2001 15:22:40] nau_sini: exit [12-APR-2001 15:22:40] nau_ini: connection type: "standard" [12-APR-2001 15:22:40] nau_ini: exit [12-APR-2001 15:22:40] naeeinit: entry [12-APR-2001 15:22:40] nam_gbp: Reading parameter "SQLNET.FIPS_140" from parameter file [12-APR-2001 15:22:40] nam_gbp: Parameter not found [12-APR-2001 15:22:40] nam_gnsp: Reading parameter "SQLNET.ENCRYPTION_CLIENT" from parameter file [12-APR-2001 15:22:40] nam_gnsp: Parameter not found [12-APR-2001 15:22:40] naequad: Using default value "ACCEPTED" [12-APR-2001 15:22:40] nam_gic: entry [12-APR-2001 15:22:40] nam_gic: Counting # of items in "SQLNET.ENCRYPTION_TYPES_CLIENT" parameter [12-APR-2001 15:22:40] nam_gic: Parameter not found [12-APR-2001 15:22:40] nam_gic: exit [12-APR-2001 15:22:40] naesno: Using default value "all available algorithms" [12-APR-2001 15:22:40] naeshow: entry [12-APR-2001 15:22:40] naeshow: These are the encryption algorithms that the client will accept: [12-APR-2001 15:22:40] naeshow: Choice 0: no algorithm; encryption inactive [12-APR-2001 15:22:40] naeshow: Choice 1: ’RC4_40’ (ID 1) [12-APR-2001 15:22:40] naeshow: Choice 2: ’RC4_56’ (ID 8) [12-APR-2001 15:22:40] naeshow: Choice 3: ’DES’ (ID 2) [12-APR-2001 15:22:40] naeshow: Choice 4: ’DES40’ (ID 3) [12-APR-2001 15:22:40] naeshow: Choice 5: ’RC4_256’ (ID 6) [12-APR-2001 15:22:40] naeshow: Choice 6: ’RC4_128’ (ID 10) [12-APR-2001 15:22:40] naeshow: Choice 7: ’3DES168’ (ID 12) [12-APR-2001 15:22:40] naeshow: Choice 8: ’3DES112’ (ID 11) [12-APR-2001 15:22:40] naeshow: exit [12-APR-2001 15:22:40] naeeinit: exit [12-APR-2001 15:22:40] naecinit: entry [12-APR-2001 15:22:40] nam_gnsp: Reading parameter "SQLNET.CRYPTO_CHECKSUM_CLIENT" from parameter file [12-APR-2001 15:22:40] nam_gnsp: Parameter not found [12-APR-2001 15:22:40] naequad: Using default value "ACCEPTED" [12-APR-2001 15:22:40] nam_gic: entry [12-APR-2001 15:22:40] nam_gic: Counting # of items in "SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT" parameter [12-APR-2001 15:22:40] nam_gic: Parameter not found [12-APR-2001 15:22:40] nam_gic: exit [12-APR-2001 15:22:40] naesno: Using default value "all available algorithms" [12-APR-2001 15:22:40] naeshow: entry [12-APR-2001 15:22:40] naeshow: These are the checksumming algorithms that the client will accept: [12-APR-2001 15:22:40] naeshow: Choice 0: no algorithm; checksumming inactive [12-APR-2001 15:22:40] naeshow: Choice 1: ’SHA1’ (ID 3) [12-APR-2001 15:22:40] naeshow: Choice 2: ’MD5’ (ID 1) [12-APR-2001 15:22:40] naeshow: exit [12-APR-2001 15:22:40] naecinit: exit [12-APR-2001 15:22:40] nainit: exit [12-APR-2001 15:22:40] nagetctxinfo: entry [12-APR-2001 15:22:40] nagetctxinfo: exit [12-APR-2001 15:22:40] nsnainit: NS Connection version: 310 [12-APR-2001 15:22:40] nsnainit: inf->nsinfflg[0]: 0x41 inf->nsinfflg[1]: 0x41 [12-APR-2001 15:22:40] nsnainit: "or" info flags: 0x41 Translations follow: native service(s) is (are) wanted [12-APR-2001 15:22:40] nsnainit: "or" info flags: 0x41 Translations follow: native service(s) is (are) wanted "and" info flags: 0x41 Translations follow: native service(s) is (are) wanted [12-APR-2001 15:22:40] nsnainit: normal exit [12-APR-2001 15:22:40] nsoptions: entry [12-APR-2001 15:22:40] nsoptions: lcl[0]=0x0, lcl[1]=0x100000, gbl[0]=0x0, gbl[1]=0x0, cha=0x0 [12-APR-2001 15:22:40] nsoptions: lcl[0]=0x1fefff, lcl[1]=0x100000, gbl[0]=0xf83f, gbl[1]=0x0 [12-APR-2001 15:22:40] nsoptions: normal exit [12-APR-2001 15:22:40] nsopen: global context check-in (to slot 0) complete [12-APR-2001 15:22:40] nsopen:

Negotiation of the encryption and integrity algorithms with the Oracle Server occurs later, however here Oracle Net sets up the resources needed.

Page 25: Analyzing Net trace

Examining Oracle Net Trace Files Page - 24 April 12, 2001

lcl[0]=0x1fefff, lcl[1]=0x100000, gbl[0]=0xf83f, gbl[1]=0x0, tdu=32767, sdu=2048 [12-APR-2001 15:22:40] nsdo: entry [12-APR-2001 15:22:40] nsdo: cid=0, opcode=65, *bl=0, *what=0, uflgs=0x0, cflgs=0x2 [12-APR-2001 15:22:40] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:40] nsdo: nsctx: state=7, flg=0x4201, mvd=0 [12-APR-2001 15:22:40] nsbal: entry [12-APR-2001 15:22:40] nsbgetfl: entry [12-APR-2001 15:22:40] nsbgetfl: normal exit [12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 44 bytes at 0x62b7a0 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nsbal: normal exit [12-APR-2001 15:22:40] nsbal: entry [12-APR-2001 15:22:40] nsbgetfl: entry [12-APR-2001 15:22:40] nsbgetfl: normal exit [12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 44 bytes at 0x62b7d0 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nsbal: normal exit [12-APR-2001 15:22:40] nsepcIniCFI: entry [12-APR-2001 15:22:40] nlidg8: entry [12-APR-2001 15:22:40] nlidg8: exit [12-APR-2001 15:22:40] nsepcIniCFI: normal exit [12-APR-2001 15:22:40] nsdo: nsctxrnk=0 [12-APR-2001 15:22:40] nsdo: normal exit [12-APR-2001 15:22:40] nsopen: normal exit

At this point, Oracle Net selected the naming method and used it to resolve the service name to a network address. It then opened the network protocol and connected the transport layer to the destination Oracle Net Listener. Oracle Net then examined if the user needed to be validated through Authentication Services, which was not needed this time. It initialized the network session and several parameters needed. The next section will explain how Oracle Net packets will traverse the network, showing the process from connection through database login.

Oracle Net initializes the Network Session. There are a variety of parameters needing to be set and eventually negotiated with the Oracle Server. Two of the parameters frequently discussed are the Transmission Data Unit (TDU) and the Session Data Unit (SDU). These parameters set up session buffers that, in some cases when properly adjusted, can increase the throughput in client/server network communications.

Page 26: Analyzing Net trace

Examining Oracle Net Trace Files Page - 25 April 12, 2001

Tracking the Flow of Packets Oracle Net function at this stage is to establish a connection between an Oracle client and an Oracle database and then transfer data. It is important to determine what packets have been sent in order to determine the cause of a problem that is suspected to be network related. A trace level of SUPPORT is required to have the packet contents written (dumped) into a trace file7, thus showing which packets have traversed the network. As pointed out earlier, each line in the trace file shows the procedures writing the message to the trace file followed by the message:

[time stamp] procedure: message or parameters

Thus, the following line:

nscon: doing connect handshake …

shows the procedure nscon is performing a connection handshake to the database server. Part of this connection handshake is to send the connection packet to the database server. The following line indicates this type of packet:

nscon: sending NSPTCN packet

The NSPTCN keyword is the packet type. The easiest way to scan a trace file for specific packet types is to search for the prefix “NSPT.” The following is the list of all the Oracle Net packet types available:

PACKET KEYWORD

PACKET TYPE PACKET NUMBER IN HEX

NSPTCN Connect 0x01 NSPTAC Accept 0x02 NSPTRF Refuse 0x04 NSPTRD Redirect 0x05 NSPTDA Data 0x06 NSPTNL Null - empty data, no flags 0x07 NSPTAB Abort 0x09 NSPTRS Resend packet 0x0B NSPTMK Marker packet 0x0C NSPTAT Attention 0x0D NSPTCNL Control information 0x0E NSPTHI Highest legal packet type 0x13

7 NOTE: The packet traversal portion is the only item in this document requires trace level 16 (SUPPORT) tracing.

Page 27: Analyzing Net trace

Examining Oracle Net Trace Files Page - 26 April 12, 2001

As mentioned above, with a trace level of SUPPORT, Oracle Net will have the procedure nspsend or nsprecv dump out the information they send to or receive from the network protocol in hexadecimal format. Sometimes the data that flows inside the packet is viewable to the right of the hexadecimal format, as in the example below. This example shows the dump of a connect packet (NSPTCN) with the data viewable to the side of the hexadecimal format. In packets dumped in this manner, it is possible to view the SQL queries or even the row data returned from the server. However, database data was not created for ASCII viewing, so the information displayed can be limited. If the data is encrypted (through Oracle Advanced Security) or EBCIDIC data is being transferred, the hexadecimal format will not translate into a viewable form. The only packets not a specific NSPT type are the security packets. To find the security packets, look for a data packet (NSPTDA) containing a “magic number” in it. Look for a NSPTDA packet containing the hexadecimal number “DE AD BE EF” displayed in the packet. That packet will be a security negotiation packet. Normally Oracle Net’s NS layer will oscillate between sending a packet and receiving one. This is not always the case. Sometimes the server has a good deal of data to send back to the client. In these cases, a series of packet receives may be displayed in the trace file. This type of behavior is highly dependant on the network protocol’s capability to stream data, such as TCP/IP’s windowing ability. Controlling this behavior in tuning the network conversation between the client and server will be a subject of a later paper and will not be covered in the scope of this document.

Page 28: Analyzing Net trace

Examining Oracle Net Trace Files Page - 27 April 12, 2001

Connecting [12-APR-2001 15:22:40] nsdo: entry [12-APR-2001 15:22:40] nsdo: cid=0, opcode=67, *bl=191, *what=8, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:40] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:40] nsdo: nsctx: state=14, flg=0x4205, mvd=0 [12-APR-2001 15:22:40] nsdo: gtn=0, gtc=0, ptn=10, ptc=2019 [12-APR-2001 15:22:40] nscon: entry [12-APR-2001 15:22:40] nscon: doing connect handshake... [12-APR-2001 15:22:40] nscon: sending NSPTCN packet [12-APR-2001 15:22:40] nspsend: entry [12-APR-2001 15:22:40] nspsend: plen=249, type=1 [12-APR-2001 15:22:40] nttwr: entry [12-APR-2001 15:22:40] nttwr: socket 156 had bytes written=249 [12-APR-2001 15:22:40] nttwr: exit [12-APR-2001 15:22:40] nspsend: 249 bytes to transport [12-APR-2001 15:22:40] nspsend: packet dump [12-APR-2001 15:22:40] nspsend: 00 F9 00 00 01 00 00 00 |........| [12-APR-2001 15:22:40] nspsend: 01 36 01 2C 00 00 08 00 |.6.,....| [12-APR-2001 15:22:40] nspsend: 7F FF A3 0A 00 00 01 00 |........| [12-APR-2001 15:22:40] nspsend: 00 BF 00 3A 00 00 02 00 |...:....| [12-APR-2001 15:22:40] nspsend: 41 41 00 00 00 00 00 00 |AA......| [12-APR-2001 15:22:40] nspsend: 00 00 00 00 01 1E 00 00 |........| [12-APR-2001 15:22:40] nspsend: 00 06 00 00 00 00 00 00 |........| [12-APR-2001 15:22:40] nspsend: 00 00 28 44 45 53 43 52 |..(DESCR| [12-APR-2001 15:22:40] nspsend: 49 50 54 49 4F 4E 3D 28 |IPTION=(| [12-APR-2001 15:22:40] nspsend: 41 44 44 52 45 53 53 3D |ADDRESS=| [12-APR-2001 15:22:40] nspsend: 28 50 52 4F 54 4F 43 4F |(PROTOCO| [12-APR-2001 15:22:40] nspsend: 4C 3D 54 43 50 29 28 48 |L=TCP)(H| [12-APR-2001 15:22:40] nspsend: 4F 53 54 3D 61 62 61 64 |OST=abad| [12-APR-2001 15:22:40] nspsend: 61 68 29 28 50 4F 52 54 |ah)(PORT| [12-APR-2001 15:22:40] nspsend: 3D 31 35 32 31 29 29 28 |=1521))(| [12-APR-2001 15:22:40] nspsend: 43 4F 4E 4E 45 43 54 5F |CONNECT_| [12-APR-2001 15:22:40] nspsend: 44 41 54 41 3D 28 53 45 |DATA=(SE| [12-APR-2001 15:22:40] nspsend: 52 56 49 43 45 5F 4E 41 |RVICE_NA| [12-APR-2001 15:22:40] nspsend: 4D 45 3D 56 38 31 37 2E |ME=V817.| [12-APR-2001 15:22:40] nspsend: 75 73 2E 6F 72 61 63 6C |us.oracl| [12-APR-2001 15:22:40] nspsend: 65 2E 63 6F 6D 29 28 43 |e.com)(C| [12-APR-2001 15:22:40] nspsend: 49 44 3D 28 50 52 4F 47 |ID=(PROG| [12-APR-2001 15:22:40] nspsend: 52 41 4D 3D 45 3A 5C 4F |RAM=E:\O| [12-APR-2001 15:22:40] nspsend: 72 61 63 6C 65 5C 4F 72 |racle\Or| [12-APR-2001 15:22:40] nspsend: 61 38 31 5C 42 49 4E 5C |a81\BIN\| [12-APR-2001 15:22:40] nspsend: 53 51 4C 50 4C 55 53 57 |SQLPLUSW| [12-APR-2001 15:22:40] nspsend: 2E 45 58 45 29 28 48 4F |.EXE)(HO| [12-APR-2001 15:22:40] nspsend: 53 54 3D 4B 41 52 45 41 |ST=KAREA| [12-APR-2001 15:22:40] nspsend: 52 44 4F 2D 50 43 29 28 |RDO-PC)(| [12-APR-2001 15:22:40] nspsend: 55 53 45 52 3D 6B 61 72 |USER=kar| [12-APR-2001 15:22:40] nspsend: 65 61 72 64 6F 29 29 29 |eardo)))| [12-APR-2001 15:22:40] nspsend: 29 00 00 00 00 00 00 00 |).......| [12-APR-2001 15:22:40] nspsend: normal exit [12-APR-2001 15:22:40] nscon: exit (0) [12-APR-2001 15:22:40] nsdo: nsctxrnk=0 [12-APR-2001 15:22:40] nsdo: normal exit [12-APR-2001 15:22:40] nsdo: entry [12-APR-2001 15:22:40] nsdo: cid=0, opcode=68, *bl=512, *what=9, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:40] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:40] nsdo: nsctx: state=2, flg=0x4205, mvd=0 [12-APR-2001 15:22:40] nsdo: gtn=0, gtc=0, ptn=10, ptc=2019 [12-APR-2001 15:22:40] nscon: entry [12-APR-2001 15:22:40] nscon: recving a packet [12-APR-2001 15:22:40] nsprecv: entry [12-APR-2001 15:22:40] nsbal: entry [12-APR-2001 15:22:40] nsbgetfl: entry [12-APR-2001 15:22:40] nsbgetfl: normal exit [12-APR-2001 15:22:40] nsmal: entry [12-APR-2001 15:22:40] nsmal: 44 bytes at 0x62b8c0 [12-APR-2001 15:22:40] nsmal: normal exit [12-APR-2001 15:22:40] nsbal: normal exit [12-APR-2001 15:22:40] nsprecv: reading from transport... [12-APR-2001 15:22:40] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=8

NS sends the Connect packet to the database listener.

The Oracle Net connect packet is more than the text inside the packet. The header of the packet (which is not covered in detail in this document) also contains the version number of Oracle Net, the maximum SDU and TDU the client can accept, hardware byte order, length of the connect data (not necessarily in this packet) and many other parameters. It is a very sophisticated packet in the Oracle Net protocol.

NS has exited normally from the send and waits to receive a packet.

Page 29: Analyzing Net trace

Examining Oracle Net Trace Files Page - 28 April 12, 2001

[12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 8 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=8, plen=8, type=11 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 00 08 00 00 0B 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nscon: got NSPTRS packet [12-APR-2001 15:22:41] nscon: no connect data [12-APR-2001 15:22:41] nscon: exit (0) [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=67, *bl=191, *what=8, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=2, flg=0x4205, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=0, gtc=0, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nscon: entry [12-APR-2001 15:22:41] nscon: sending NSPTCN packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=249, type=1 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=249 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 249 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 00 F9 00 00 01 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 01 36 01 2C 00 00 08 00 |.6.,....| [12-APR-2001 15:22:41] nspsend: 7F FF A3 0A 00 00 01 00 |........| [12-APR-2001 15:22:41] nspsend: 00 BF 00 3A 00 00 02 00 |...:....| [12-APR-2001 15:22:41] nspsend: 41 41 00 00 00 00 00 00 |AA......| [12-APR-2001 15:22:41] nspsend: 00 00 00 00 01 1E 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 06 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 28 44 45 53 43 52 |..(DESCR| [12-APR-2001 15:22:41] nspsend: 49 50 54 49 4F 4E 3D 28 |IPTION=(| [12-APR-2001 15:22:41] nspsend: 41 44 44 52 45 53 53 3D |ADDRESS=| [12-APR-2001 15:22:41] nspsend: 28 50 52 4F 54 4F 43 4F |(PROTOCO| [12-APR-2001 15:22:41] nspsend: 4C 3D 54 43 50 29 28 48 |L=TCP)(H| [12-APR-2001 15:22:41] nspsend: 4F 53 54 3D 61 62 61 64 |OST=abad| [12-APR-2001 15:22:41] nspsend: 61 68 29 28 50 4F 52 54 |ah)(PORT| [12-APR-2001 15:22:41] nspsend: 3D 31 35 32 31 29 29 28 |=1521))(| [12-APR-2001 15:22:41] nspsend: 43 4F 4E 4E 45 43 54 5F |CONNECT_| [12-APR-2001 15:22:41] nspsend: 44 41 54 41 3D 28 53 45 |DATA=(SE| [12-APR-2001 15:22:41] nspsend: 52 56 49 43 45 5F 4E 41 |RVICE_NA| [12-APR-2001 15:22:41] nspsend: 4D 45 3D 56 38 31 37 2E |ME=V817.| [12-APR-2001 15:22:41] nspsend: 75 73 2E 6F 72 61 63 6C |us.oracl| [12-APR-2001 15:22:41] nspsend: 65 2E 63 6F 6D 29 28 43 |e.com)(C| [12-APR-2001 15:22:41] nspsend: 49 44 3D 28 50 52 4F 47 |ID=(PROG| [12-APR-2001 15:22:41] nspsend: 52 41 4D 3D 45 3A 5C 4F |RAM=E:\O| [12-APR-2001 15:22:41] nspsend: 72 61 63 6C 65 5C 4F 72 |racle\Or| [12-APR-2001 15:22:41] nspsend: 61 38 31 5C 42 49 4E 5C |a81\BIN\| [12-APR-2001 15:22:41] nspsend: 53 51 4C 50 4C 55 53 57 |SQLPLUSW| [12-APR-2001 15:22:41] nspsend: 2E 45 58 45 29 28 48 4F |.EXE)(HO| [12-APR-2001 15:22:41] nspsend: 53 54 3D 4B 41 52 45 41 |ST=KAREA| [12-APR-2001 15:22:41] nspsend: 52 44 4F 2D 50 43 29 28 |RDO-PC)(| [12-APR-2001 15:22:41] nspsend: 55 53 45 52 3D 6B 61 72 |USER=kar| [12-APR-2001 15:22:41] nspsend: 65 61 72 64 6F 29 29 29 |eardo)))| [12-APR-2001 15:22:41] nspsend: 29 00 00 00 00 00 00 00 |).......| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nscon: exit (0) [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit

The listener on the server sent a NSPTRS packet. Sending the NSPTCN packet.

For some operating systems a NSPTRD (redirect) packet is sent instead. This is because the database was either configured to use Multi-Threaded Server, or the server shadow process was given a different port then the listener. The NSPTRD packet would have the network protocol address information needed to connect to this other process. Oracle Net would then close the network protocol and reopen a network connection to the new address.

NOTE: If a firewall is not running an Oracle Net Proxy service or the equivalent, it is possible that an error is generated in the next section due to TCP/IP port redirection.

Page 30: Analyzing Net trace

Examining Oracle Net Trace Files Page - 29 April 12, 2001

[12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=68, *bl=512, *what=9, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=2, flg=0x4205, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=0, gtc=0, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nscon: entry [12-APR-2001 15:22:41] nscon: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=32 [12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 32 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=32, plen=32, type=2 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 00 20 00 00 02 00 00 00 |. ......| [12-APR-2001 15:22:41] nsprecv: 01 36 00 00 08 00 7F FF |.6......| [12-APR-2001 15:22:41] nsprecv: 00 01 00 00 00 20 41 41 |..... AA| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nscon: got NSPTAC packet [12-APR-2001 15:22:41] nsconneg: entry 12-APR-2001 15:22:41] nsconneg: vsn=310, gbl=0x0, sdu=2048, tdu=32767 [12-APR-2001 15:22:41] nsconneg: normal exit [12-APR-2001 15:22:41] nscon: no connect data [12-APR-2001 15:22:41] nscon: doing connect handshake... [12-APR-2001 15:22:41] nscon: nsctxinf[0]=0x41, [1]=0x41 [12-APR-2001 15:22:41] nscon: normal exit [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsnaconn: entry [12-APR-2001 15:22:41] nagetctxinfo: entry [12-APR-2001 15:22:41] nagetctxinfo: exit [12-APR-2001 15:22:41] nsnainconn: entry [12-APR-2001 15:22:41] nsnainconn: inf->nsinfflg[0]: 0x41 inf->nsinfflg[1]: 0x41 [12-APR-2001 15:22:41] nsnainconn: "or" info flags: 0x41 Translations follow: native service(s) is (are) wanted [12-APR-2001 15:22:41] nsnainconn: "or" info flags: 0x41 Translations follow: native service(s) is (are) wanted "and" info flags: 0x41 Translations follow: native service(s) is (are) wanted [12-APR-2001 15:22:41] nsnainconn: normal exit [12-APR-2001 15:22:41] nsnadoconn: entry [12-APR-2001 15:22:41] naconnect: entry [12-APR-2001 15:22:41] naconnect: >>>>>>> PASS: 0 [12-APR-2001 15:22:41] snauiinit: entry

NS has exited normally from the send and waits to receive a packet.

The listener on the server returned a NSPTAC packet. This is also a sophisticated packet, and contains the same information the initial connect packet had in its header. Note the SDU and TDU have changed as they have been negotiated.

Oracle Net begins the security negotiation by setting up the encryption and integrity algorithms and the system resources they will need. Oracle couples encryption, integrity, and authentication in its security offerings so this code is bundled in the NA layer. The security packets created during the process Oracle lovingly refers to as DE AD BE EF packets (as mentioned above).

NOTE: These packets, and all the rest in the trace, are NSPTDA packets. The special packets of Oracle Netare finished being used as the network session connection between the client and the server is complete.

Page 31: Analyzing Net trace

Examining Oracle Net Trace Files Page - 30 April 12, 2001

Security Negotiation [12-APR-2001 15:22:41] na_info: entry [12-APR-2001 15:22:41] nas_version: entry [12-APR-2001 15:22:41] nas_version: exit [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending version stamp 0x8106000 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: supervisor data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] na_info: Oracle Advanced Security: supervisor service for 32-bit Windows: Version 8.1.6.0.0 - Production [12-APR-2001 15:22:41] nau_info: entry [12-APR-2001 15:22:41] nau_info: exit [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending version stamp 0x8107000 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: authentication data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] na_info: Oracle Advanced Security: authentication service for 32-bit Windows: Version 8.1.7.0.0 - Production [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending version stamp 0x8107000 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: encryption data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] na_info: Oracle Advanced Security: encryption service for 32-bit Windows: Version 8.1.7.0.0 - Production [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending version stamp 0x8107000 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: crypto-checksumming data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] na_info: Oracle Advanced Security: crypto-checksumming service for 32-bit Windows: Version 8.1.7.0.0 - Production [12-APR-2001 15:22:41] na_info: exit

Supervisor Service

Authentication Service

Encryption Service

Crypto-Checksumming Service

Oracle Net reads the security configuration information.

Note the direction is outbound as this packet is to be sent to the listener.

Page 32: Analyzing Net trace

Examining Oracle Net Trace Files Page - 31 April 12, 2001

[12-APR-2001 15:22:41] snauiinit: exit [12-APR-2001 15:22:41] na_client: entry [12-APR-2001 15:22:41] na_ccas: entry [12-APR-2001 15:22:41] nas_ccn: entry [12-APR-2001 15:22:41] nas_ccn: Connection ID: 0011ef77d411 [12-APR-2001 15:22:41] nacomsd: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: supervisor data type: raw data data length: 8 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsd: exit [12-APR-2001 15:22:41] nacomsa: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsa: Sending array of type 2 byte numeric with 4 elements [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: supervisor data type: raw data data length: 18 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsa: exit [12-APR-2001 15:22:41] nas_ccn: exit [12-APR-2001 15:22:41] nau_ccn: entry [12-APR-2001 15:22:41] nau_gpl: entry [12-APR-2001 15:22:41] nau_gpl: authentication disabled - service list not retrieved [12-APR-2001 15:22:41] nau_gpl: exit [12-APR-2001 15:22:41] nau_css: entry [12-APR-2001 15:22:41] nau_csct: entry [12-APR-2001 15:22:41] nau_csct: sending connection type: client/server [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending 2 byte numeric 57569 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: authentication data type: 2 byte numeric data length: 2 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] nau_csct: exit [12-APR-2001 15:22:41] nau_cst: entry [12-APR-2001 15:22:41] nau_cst: sending client status: authentication disabled (simulated as having no drivers linked in) [12-APR-2001 15:22:41] nacomsu: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomsu: sending status 0xfeff [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: authentication data type: status data length: 2 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsu: exit [12-APR-2001 15:22:41] nau_cst: exit [12-APR-2001 15:22:41] nau_css: no negotiation to be done - quitting [12-APR-2001 15:22:41] nau_css: exit [12-APR-2001 15:22:41] nau_ccn: exit

Page 33: Analyzing Net trace

Examining Oracle Net Trace Files Page - 32 April 12, 2001

[12-APR-2001 15:22:41] naeecn: entry [12-APR-2001 15:22:41] nacomsd: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: encryption data type: raw data data length: 9 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsd: exit [12-APR-2001 15:22:41] naeecn: exit [12-APR-2001 15:22:41] naeccn: entry [12-APR-2001 15:22:41] nacomsd: entry [12-APR-2001 15:22:41] nacomfsd: entry [12-APR-2001 15:22:41] nacomfsd: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: outbound service: crypto-checksumming data type: raw data data length: 3 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomsd: exit [12-APR-2001 15:22:41] naeccn: exit [12-APR-2001 15:22:41] na_ccas: exit [12-APR-2001 15:22:41] nacomsn: entry [12-APR-2001 15:22:41] nacomap: entry [12-APR-2001 15:22:41] nacomap: Packet length 143 # of services 4 Error sent? FALSE [12-APR-2001 15:22:41] nacomap: Version transmitted: Oracle Advanced Security: Oracle Advanced Security for 32-bit Windows: Version 8.1.6.0.0 - Production [12-APR-2001 15:22:41] nacomps: entry [12-APR-2001 15:22:41] nacomps: service supervisor # of fields 3 ORACLE error 0 [12-APR-2001 15:22:41] nacomps: data length 4 data type version stamp [12-APR-2001 15:22:41] nacomps: data length 8 data type raw data [12-APR-2001 15:22:41] nacomps: data length 18 data type raw data [12-APR-2001 15:22:41] nacomps: service authentication # of fields 3 ORACLE error 0 [12-APR-2001 15:22:41] nacomps: data length 4 data type version stamp [12-APR-2001 15:22:41] nacomps: data length 2 data type 2 byte numeric [12-APR-2001 15:22:41] nacomps: data length 2 data type status [12-APR-2001 15:22:41] nacomps: service encryption # of fields 2 ORACLE error 0 [12-APR-2001 15:22:41] nacomps: data length 4 data type version stamp [12-APR-2001 15:22:41] nacomps: data length 9 data type raw data [12-APR-2001 15:22:41] nacomps: service crypto-checksumming # of fields 2 ORACLE error 0 [12-APR-2001 15:22:41] nacomps: data length 4 data type version stamp [12-APR-2001 15:22:41] nacomps: data length 3 data type raw data [12-APR-2001 15:22:41] nacomps: exit [12-APR-2001 15:22:41] nacomap: exit

Security is configured. Oracle Net creates the DEAD BEEF packet.

Page 34: Analyzing Net trace

Examining Oracle Net Trace Files Page - 33 April 12, 2001

[12-APR-2001 15:22:41] nacomsn: sending 143 bytes [12-APR-2001 15:22:41] nsnasend: entry [12-APR-2001 15:22:41] nsnasend: bytes to send: 143 [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=67, *bl=143, *what=1, uflgs=0x22, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x2420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=32, gtc=32, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdo: 143 bytes to NS buffer [12-APR-2001 15:22:41] nsdoacts: entry [12-APR-2001 15:22:41] nsdofls: entry [12-APR-2001 15:22:41] nsdofls: DATA flags: 0x0 [12-APR-2001 15:22:41] nsdofls: sending NSPTDA packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=153, type=6 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=153 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 153 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 00 99 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 DE AD BE EF 00 8F |........| [12-APR-2001 15:22:41] nspsend: 08 10 60 00 00 04 00 00 |..‘.....| [12-APR-2001 15:22:41] nspsend: 04 00 03 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 04 00 05 08 10 60 00 00 |.....‘..| [12-APR-2001 15:22:41] nspsend: 08 00 01 00 00 01 1E F7 |........| [12-APR-2001 15:22:41] nspsend: 7D 04 11 00 12 00 01 DE |}.......| [12-APR-2001 15:22:41] nspsend: AD BE EF 00 03 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 04 00 04 00 01 00 01 00 |........| [12-APR-2001 15:22:41] nspsend: 01 00 01 00 03 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 04 00 05 08 10 70 |.......p| [12-APR-2001 15:22:41] nspsend: 00 00 02 00 03 E0 E1 00 |........| [12-APR-2001 15:22:41] nspsend: 02 00 06 FE FF 00 02 00 |........| [12-APR-2001 15:22:41] nspsend: 02 00 00 00 00 00 04 00 |........| [12-APR-2001 15:22:41] nspsend: 05 08 10 70 00 00 09 00 |...p....| [12-APR-2001 15:22:41] nspsend: 01 00 01 08 02 03 06 0A |........| [12-APR-2001 15:22:41] nspsend: 0C 0B 00 03 00 02 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 00 04 00 05 08 10 |........| [12-APR-2001 15:22:41] nspsend: 70 00 00 03 00 01 00 03 |p.......| [12-APR-2001 15:22:41] nspsend: 01 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nsdofls: exit (0) [12-APR-2001 15:22:41] nsdoacts: flushing transport [12-APR-2001 15:22:41] nttctl: entry [12-APR-2001 15:22:41] nsdoacts: normal exit [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsnasend: normal exit [12-APR-2001 15:22:41] nacompd: entry [12-APR-2001 15:22:41] nacompd: exit [12-APR-2001 15:22:41] nacomsn: exit [12-APR-2001 15:22:41] snauicomparehash: entry [12-APR-2001 15:22:41] nacomrc: entry [12-APR-2001 15:22:41] nsnareceive: entry [12-APR-2001 15:22:41] nsnareceive: buffer address: 0x12a99c bytes wanted: 2048 [12-APR-2001 15:22:41] nsnareceive: calling NS to receive 2048 bytes into address 0x12a99c [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=68, *bl=2048, *what=0, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x2420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=32, gtc=32, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsrdr: entry [12-APR-2001 15:22:41] nsrdr: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=127 [12-APR-2001 15:22:41] nttrd: exit

Now the DEAD BEEF packet has been created, NA forwards the information to NS to send.

This is why it is called a DEAD BEEF packet. The hexadecimal “magic number” can be scaned for to separate this packet from the rest. If the problem being researched is security related, scan the trace file for this letter combination.

NS informs NA that the DEAD BEEF packet was sent. NS waits to read the next packet.

Page 35: Analyzing Net trace

Examining Oracle Net Trace Files Page - 34 April 12, 2001

[12-APR-2001 15:22:41] nsprecv: 127 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=127, plen=127, type=6 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 00 7F 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 DE AD BE EF 00 75 |.......u| [12-APR-2001 15:22:41] nsprecv: 08 10 70 00 00 04 00 00 |..p.....| [12-APR-2001 15:22:41] nsprecv: 04 00 03 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 04 00 05 08 10 70 00 00 |.....p..| [12-APR-2001 15:22:41] nsprecv: 02 00 06 00 1F 00 0E 00 |........| [12-APR-2001 15:22:41] nsprecv: 01 DE AD BE EF 00 03 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 02 00 04 00 01 00 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 02 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 04 00 05 08 10 70 00 00 |.....p..| [12-APR-2001 15:22:41] nsprecv: 02 00 06 FB FF 00 02 00 |........| [12-APR-2001 15:22:41] nsprecv: 02 00 00 00 00 00 04 00 |........| [12-APR-2001 15:22:41] nsprecv: 05 08 10 70 00 00 01 00 |...p....| [12-APR-2001 15:22:41] nsprecv: 02 00 00 03 00 02 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 04 00 05 08 10 |........| [12-APR-2001 15:22:41] nsprecv: 70 00 00 01 00 02 00 00 |p.......| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nsrdr: got NSPTDA packet [12-APR-2001 15:22:41] nsrdr: NSPTDA flags: 0x0 [12-APR-2001 15:22:41] nsrdr: normal exit [12-APR-2001 15:22:41] nsdo: *what=1, *bl=2048 [12-APR-2001 15:22:41] nsdo: 117 bytes from NS buffer [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsnareceive: received 117 bytes [12-APR-2001 15:22:41] nsnareceive: no more data to receive - returning [12-APR-2001 15:22:41] nsnareceive: normal exit [12-APR-2001 15:22:41] nsnareceive: total bytes received: 117 [12-APR-2001 15:22:41] nacomrc: received 117 bytes [12-APR-2001 15:22:41] nacomrc: total data length: 117 bytes [12-APR-2001 15:22:41] nacomrc: Version received: Oracle Advanced Security: Oracle Advanced Security for 32-bit Windows: Version 8.1.7.0.0 - Production [12-APR-2001 15:22:41] nacomrc: Length 117 # of services 4 Error rec’d? FALSE [12-APR-2001 15:22:41] nacomus: entry [12-APR-2001 15:22:41] nacomus: service supervisor # of fields 3 ORACLE error 0 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: supervisor data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: supervisor data type: status data length: 2 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: supervisor data type: raw data data length: 14 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomus: exit [12-APR-2001 15:22:41] nacomus: entry [12-APR-2001 15:22:41] nacomus: service authentication # of fields 2 ORACLE error 0 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: authentication data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit

NS forwards the DEAD BEEF packet to NA for deciphering.

Page 36: Analyzing Net trace

Examining Oracle Net Trace Files Page - 35 April 12, 2001

[12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: authentication data type: status data length: 2 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomus: exit [12-APR-2001 15:22:41] nacomus: entry [12-APR-2001 15:22:41] nacomus: service encryption # of fields 2 ORACLE error 0 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: encryption data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: encryption data type: 1 byte numeric data length: 1 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomus: exit [12-APR-2001 15:22:41] nacomus: entry [12-APR-2001 15:22:41] nacomus: service crypto-checksumming # of fields 2 ORACLE error 0 [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: crypto-checksumming data type: version stamp data length: 4 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomdp: entry [12-APR-2001 15:22:41] nacomdp: direction: inbound service: crypto-checksumming data type: 1 byte numeric data length: 1 [12-APR-2001 15:22:41] nacomdp: exit [12-APR-2001 15:22:41] nacomus: exit [12-APR-2001 15:22:41] nacomrc: exit [12-APR-2001 15:22:41] snauicomparehash: exit [12-APR-2001 15:22:41] na_csrd: entry [12-APR-2001 15:22:41] nas_ccn: entry [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] nas_gusl: exit [12-APR-2001 15:22:41] nas_ccn: exit [12-APR-2001 15:22:41] nau_ccn: entry [12-APR-2001 15:22:41] nau_rpv: entry [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] nau_rpv: Version received for 32-bit Windows: Version 8.1.7.0.0 - UNKNOWN [12-APR-2001 15:22:41] nau_rpv: Connection version for 32-bit Windows: Version 8.1.7.0.0 - UNKNOWN [12-APR-2001 15:22:41] nau_rpv: adapter version communication is supported by other process [12-APR-2001 15:22:41] nau_rpv: exit [12-APR-2001 15:22:41] nau_cga: entry [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] nau_cga: exit [12-APR-2001 15:22:41] nau_ccn: client handshake succeeded [12-APR-2001 15:22:41] nau_ccn: exit [12-APR-2001 15:22:41] naeecn: entry [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit

Page 37: Analyzing Net trace

Examining Oracle Net Trace Files Page - 36 April 12, 2001

[12-APR-2001 15:22:41] naeecn: exit [12-APR-2001 15:22:41] naeccn: entry [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] nacomrp: entry [12-APR-2001 15:22:41] nacomrp: exit [12-APR-2001 15:22:41] naeccn: exit [12-APR-2001 15:22:41] na_csrd: exit [12-APR-2001 15:22:41] na_client: all services done [12-APR-2001 15:22:41] na_client: exit [12-APR-2001 15:22:41] na_coco: entry [12-APR-2001 15:22:41] nau_cco: entry [12-APR-2001 15:22:41] nau_dis: entry [12-APR-2001 15:22:41] nau_fad: exit [12-APR-2001 15:22:41] nau_dis: exit [12-APR-2001 15:22:41] nau_cco: exit [12-APR-2001 15:22:41] naeecom: entry [12-APR-2001 15:22:41] naeecom: Encryption inactive [12-APR-2001 15:22:41] naeecom: exit [12-APR-2001 15:22:41] naeccom: entry [12-APR-2001 15:22:41] naeccom: Crypto-Checksumming inactive [12-APR-2001 15:22:41] naeccom: exit [12-APR-2001 15:22:41] na_tns: entry [12-APR-2001 15:22:41] na_tns: Secure Network Services is available. [12-APR-2001 15:22:41] nau_adi: entry [12-APR-2001 15:22:41] nau_adi: exit [12-APR-2001 15:22:41] na_tns: authentication is not active [12-APR-2001 15:22:41] na_tns: encryption is not active [12-APR-2001 15:22:41] na_tns: crypto-checksumming is not active [12-APR-2001 15:22:41] na_tns: exit [12-APR-2001 15:22:41] na_coco: exit [12-APR-2001 15:22:41] naconnect: exit [12-APR-2001 15:22:41] nsnafinishconn: entry [12-APR-2001 15:22:41] nagetctxinfo: entry [12-APR-2001 15:22:41] nagetctxinfo: exit [12-APR-2001 15:22:41] nsnafinishconn: normal exit [12-APR-2001 15:22:41] nsnadoconn: normal exit [12-APR-2001 15:22:41] nsnaconn: normal exit [12-APR-2001 15:22:41] nscall: normal exit [12-APR-2001 15:22:41] niotns: niotns: passing ns handle back up... [12-APR-2001 15:22:41] nsballoc: entry [12-APR-2001 15:22:41] nsbgetfl: entry [12-APR-2001 15:22:41] nsbgetfl: normal exit [12-APR-2001 15:22:41] nsmal: entry [12-APR-2001 15:22:41] nsmal: 44 bytes at 0x62c3c0 [12-APR-2001 15:22:41] nsmal: normal exit [12-APR-2001 15:22:41] nsballoc: normal exit [12-APR-2001 15:22:41] nsballoc: entry [12-APR-2001 15:22:41] nsbgetfl: entry [12-APR-2001 15:22:41] nsbgetfl: normal exit [12-APR-2001 15:22:41] nsmal: entry [12-APR-2001 15:22:41] nsmal: 44 bytes at 0x62c3f0 [12-APR-2001 15:22:41] nsmal: normal exit [12-APR-2001 15:22:41] nsballoc: normal exit [12-APR-2001 15:22:41] niotns: exit

Two-Task Common Two-Task Common (TTC) is Oracle’s implementation of the OSI Presentation Layer. TTC provides the negotiation of the version of Oracle Net, character set and data type translation between the different operating systems on the client and server. This layer is optimized on a per-connection basis to perform data conversion only when required. TTC is responsible for evaluating the differences in internal data and character set representations in Operating Systems and determine if a conversion is required for the two computers to communicate. This is determined first by exchanging the type of

All necessary algorithms have been initialized and negotiated (if they were enabled). In this trace, none were enabled so security is inactive.

Page 38: Analyzing Net trace

Examining Oracle Net Trace Files Page - 37 April 12, 2001

operating systems, and version of Oracle Net Protocol, followed by the data type translation (if needed). [12-APR-2001 15:22:41] nioqsn: entry [12-APR-2001 15:22:41] nioqrc: entry [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=84, *bl=0, *what=1, uflgs=0x20, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdofls: entry [12-APR-2001 15:22:41] nsdofls: DATA flags: 0x0 [12-APR-2001 15:22:41] nsdofls: sending NSPTDA packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=37, type=6 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=37 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 37 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 00 25 00 00 06 00 00 00 |.%......| [12-APR-2001 15:22:41] nspsend: 00 00 01 06 05 04 03 02 |........| [12-APR-2001 15:22:41] nspsend: 01 00 49 42 4D 50 43 2F |..IBMPC/| [12-APR-2001 15:22:41] nspsend: 57 49 4E 5F 4E 54 2D 38 |WIN_NT-8| [12-APR-2001 15:22:41] nspsend: 2E 31 2E 30 00 00 00 00 |.1.0....| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nsdofls: exit (0) [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=85, *bl=0, *what=0, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdo: switching to application buffer [12-APR-2001 15:22:41] nsrdr: entry [12-APR-2001 15:22:41] nsrdr: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=140 [12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 140 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=140, plen=140, type=6 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 00 8C 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 01 06 00 53 56 52 |.....SVR| [12-APR-2001 15:22:41] nsprecv: 34 2D 62 65 2D 38 2E 31 |4-be-8.1| [12-APR-2001 15:22:41] nsprecv: 2E 30 00 01 00 00 00 00 |.0......| [12-APR-2001 15:22:41] nsprecv: 00 64 00 00 00 60 01 21 |.d...‘.!| [12-APR-2001 15:22:41] nsprecv: 0F 05 0B 0C 03 0C 0C 05 |........| [12-APR-2001 15:22:41] nsprecv: 04 05 0D 06 09 07 08 05 |........| [12-APR-2001 15:22:41] nsprecv: 0F 05 05 05 0F 05 05 05 |........| [12-APR-2001 15:22:41] nsprecv: 05 05 0A 05 05 05 05 05 |........| [12-APR-2001 15:22:41] nsprecv: 04 05 08 23 47 23 23 08 |...#G##.| [12-APR-2001 15:22:41] nsprecv: 11 23 08 11 41 B0 23 00 |.#..A.#.| [12-APR-2001 15:22:41] nsprecv: 83 00 01 00 01 13 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 02 06 |........| [12-APR-2001 15:22:41] nsprecv: 01 02 02 01 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nsrdr: got NSPTDA packet [12-APR-2001 15:22:41] nsrdr: NSPTDA flags: 0x0 [12-APR-2001 15:22:41] nsrdr: normal exit [12-APR-2001 15:22:41] nsdo: *what=1, *bl=2009 [12-APR-2001 15:22:41] nsdo: nsctxrnk=0

Receiving OS Type and Oracle Net version from the server.

Sending OS Type and Oracle Net version to the server.

Page 39: Analyzing Net trace

Examining Oracle Net Trace Files Page - 38 April 12, 2001

[12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nioqrc: exit [12-APR-2001 15:22:41] nioqsn: entry [12-APR-2001 15:22:41] nioqrc: entry [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=84, *bl=0, *what=1, uflgs=0x20, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdofls: entry [12-APR-2001 15:22:41] nsdofls: DATA flags: 0x0 [12-APR-2001 15:22:41] nsdofls: sending NSPTDA packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=964, type=6 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=964 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 964 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 03 C4 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 02 01 00 01 00 00 |........| [12-APR-2001 15:22:41] nspsend: 02 06 01 02 02 01 80 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 3C 3C 3C 80 00 00 |..<<<...| [12-APR-2001 15:22:41] nspsend: 00 01 01 01 00 02 02 0A |........| [12-APR-2001 15:22:41] nspsend: 00 08 08 01 00 0C 0C 0A |........| [12-APR-2001 15:22:41] nspsend: 00 17 17 01 00 18 18 01 |........| [12-APR-2001 15:22:41] nspsend: 00 19 19 18 19 01 00 1A |........| [12-APR-2001 15:22:41] nspsend: 1A 19 1A 01 00 1B 1B 0A |........| [12-APR-2001 15:22:41] nspsend: 1B 01 00 1C 1C 16 1C 01 |........| [12-APR-2001 15:22:41] nspsend: 00 1D 1D 17 1D 01 00 1E |........| [12-APR-2001 15:22:41] nspsend: 1E 17 1E 01 00 1F 1F 19 |........| [12-APR-2001 15:22:41] nspsend: 1F 01 00 20 20 0A 20 01 |... . .| [12-APR-2001 15:22:41] nspsend: 00 21 21 0A 21 01 00 0A |.!!.!...| [12-APR-2001 15:22:41] nspsend: 0A 01 00 0B 0B 01 00 22 |......."| [12-APR-2001 15:22:41] nspsend: 22 01 00 23 23 01 23 01 |"..##.#.| [12-APR-2001 15:22:41] nspsend: 00 24 24 01 00 25 25 01 |.$$..%%.| [12-APR-2001 15:22:41] nspsend: 00 26 26 01 00 28 28 01 |.&&..((.| [12-APR-2001 15:22:41] nspsend: 00 29 29 01 00 2A 2A 01 |.))..**.| [12-APR-2001 15:22:41] nspsend: 00 2B 2B 01 00 2C 2C 01 |.++..,,.| [12-APR-2001 15:22:41] nspsend: 00 2D 2D 01 00 2E 2E 01 |.--.....| [12-APR-2001 15:22:41] nspsend: 00 2F 2F 01 00 30 30 01 |.//..00.| [12-APR-2001 15:22:41] nspsend: 00 31 31 01 00 32 32 01 |.11..22.| [12-APR-2001 15:22:41] nspsend: 00 33 33 01 00 34 34 01 |.33..44.| [12-APR-2001 15:22:41] nspsend: 00 35 35 01 00 36 36 01 |.55..66.| [12-APR-2001 15:22:41] nspsend: 00 37 37 01 00 38 38 01 |.77..88.| [12-APR-2001 15:22:41] nspsend: 00 39 39 01 00 3B 3B 01 |.99..;;.| [12-APR-2001 15:22:41] nspsend: 00 3C 3C 01 00 3D 3D 01 |.<<..==.| [12-APR-2001 15:22:41] nspsend: 00 3E 3E 01 00 3F 3F 01 |.>>..??.| [12-APR-2001 15:22:41] nspsend: 00 40 40 01 00 41 41 01 |.@@..AA.| [12-APR-2001 15:22:41] nspsend: 00 42 42 01 00 43 43 01 |.BB..CC.| [12-APR-2001 15:22:41] nspsend: 00 47 47 01 00 48 48 01 |.GG..HH.| [12-APR-2001 15:22:41] nspsend: 00 49 49 01 00 4B 4B 01 |.II..KK.| [12-APR-2001 15:22:41] nspsend: 00 4D 4D 01 00 4E 4E 01 |.MM..NN.| [12-APR-2001 15:22:41] nspsend: 00 4F 4F 01 00 50 50 01 |.OO..PP.| [12-APR-2001 15:22:41] nspsend: 00 51 51 01 00 52 52 01 |.QQ..RR.| [12-APR-2001 15:22:41] nspsend: 00 53 53 01 00 54 54 01 |.SS..TT.| [12-APR-2001 15:22:41] nspsend: 00 55 55 01 00 56 56 01 |.UU..VV.| [12-APR-2001 15:22:41] nspsend: 00 57 57 01 57 01 00 59 |.WW.W..Y| [12-APR-2001 15:22:41] nspsend: 59 01 00 5A 5A 01 00 5C |Y..ZZ..\| [12-APR-2001 15:22:41] nspsend: 5C 01 00 5D 5D 01 00 62 |\..]]..b| [12-APR-2001 15:22:41] nspsend: 62 01 00 63 63 01 00 67 |b..cc..g| [12-APR-2001 15:22:41] nspsend: 67 01 00 6B 6B 01 00 75 |g..kk..u| [12-APR-2001 15:22:41] nspsend: 75 01 00 78 78 01 00 7C |u..xx..|| [12-APR-2001 15:22:41] nspsend: 7C 01 42 01 00 7D 7D 01 ||.B..}}.| [12-APR-2001 15:22:41] nspsend: 00 7E 7E 01 00 7F 7F 01 |.~~.....| [12-APR-2001 15:22:41] nspsend: 00 80 80 01 00 81 81 01 |........| [12-APR-2001 15:22:41] nspsend: 00 82 82 01 00 83 83 01 |........| [12-APR-2001 15:22:41] nspsend: 00 84 84 01 00 85 85 01 |........| [12-APR-2001 15:22:41] nspsend: 00 86 86 01 00 87 87 01 |........| [12-APR-2001 15:22:41] nspsend: 00 89 89 01 00 8A 8A 01 |........| [12-APR-2001 15:22:41] nspsend: 00 8B 8B 01 00 8C 8C 01 |........|

The client sends the server a character set and conversion graph it supports.

Page 40: Analyzing Net trace

Examining Oracle Net Trace Files Page - 39 April 12, 2001

[12-APR-2001 15:22:41] nspsend: 00 8D 8D 01 00 8E 8E 01 |........| [12-APR-2001 15:22:41] nspsend: 00 8F 8F 01 00 90 90 01 |........| [12-APR-2001 15:22:41] nspsend: 00 91 91 01 00 94 94 01 |........| [12-APR-2001 15:22:41] nspsend: 25 01 00 95 95 01 00 96 |%.......| [12-APR-2001 15:22:41] nspsend: 96 01 00 97 97 01 00 9D |........| [12-APR-2001 15:22:41] nspsend: 9D 01 00 9E 9E 01 00 9F |........| [12-APR-2001 15:22:41] nspsend: 9F 01 00 A0 A0 01 00 A1 |........| [12-APR-2001 15:22:41] nspsend: A1 01 00 A2 A2 01 00 A3 |........| [12-APR-2001 15:22:41] nspsend: A3 01 00 A4 A4 01 00 A5 |........| [12-APR-2001 15:22:41] nspsend: A5 01 00 A6 A6 01 00 A7 |........| [12-APR-2001 15:22:41] nspsend: A7 01 00 A8 A8 01 00 A9 |........| [12-APR-2001 15:22:41] nspsend: A9 01 00 AA AA 01 00 AB |........| [12-APR-2001 15:22:41] nspsend: AB 01 00 AD AD 01 00 AE |........| [12-APR-2001 15:22:41] nspsend: AE 01 00 AF AF 01 00 B0 |........| [12-APR-2001 15:22:41] nspsend: B0 01 00 B1 B1 01 00 C1 |........| [12-APR-2001 15:22:41] nspsend: C1 01 00 C2 C2 01 25 01 |......%.| [12-APR-2001 15:22:41] nspsend: 00 C6 C6 01 00 C7 C7 01 |........| [12-APR-2001 15:22:41] nspsend: 00 C8 C8 01 00 C9 C9 01 |........| [12-APR-2001 15:22:41] nspsend: 00 CA CA 01 9F 01 00 CB |........| [12-APR-2001 15:22:41] nspsend: CB 01 A0 01 00 CC CC 01 |........| [12-APR-2001 15:22:41] nspsend: A2 01 00 CD CD 01 A3 01 |........| [12-APR-2001 15:22:41] nspsend: 00 CE CE 01 B1 01 00 CF |........| [12-APR-2001 15:22:41] nspsend: CF 01 22 01 00 D2 D2 01 |..".....| [12-APR-2001 15:22:41] nspsend: 00 D3 D3 01 AB 01 00 D6 |........| [12-APR-2001 15:22:41] nspsend: D6 01 00 D7 D7 01 00 D8 |........| [12-APR-2001 15:22:41] nspsend: D8 01 00 D9 D9 01 00 DA |........| [12-APR-2001 15:22:41] nspsend: DA 01 00 DB DB 01 00 DC |........| [12-APR-2001 15:22:41] nspsend: DC 01 00 DD DD 01 00 DE |........| [12-APR-2001 15:22:41] nspsend: DE 01 00 DF DF 01 00 E0 |........| [12-APR-2001 15:22:41] nspsend: E0 01 00 E1 E1 01 00 E2 |........| [12-APR-2001 15:22:41] nspsend: E2 01 00 E3 E3 01 6B 01 |......k.| [12-APR-2001 15:22:41] nspsend: 00 E4 E4 01 00 E5 E5 01 |........| [12-APR-2001 15:22:41] nspsend: 00 E6 E6 01 00 EA EA 01 |........| [12-APR-2001 15:22:41] nspsend: 00 03 02 0A 00 04 02 0A |........| [12-APR-2001 15:22:41] nspsend: 00 05 01 01 00 06 02 0A |........| [12-APR-2001 15:22:41] nspsend: 00 07 02 0A 00 09 01 01 |........| [12-APR-2001 15:22:41] nspsend: 00 0D 00 0E 00 0F 17 01 |........| [12-APR-2001 15:22:41] nspsend: 00 10 00 11 00 12 00 13 |........| [12-APR-2001 15:22:41] nspsend: 00 14 00 15 00 16 00 27 |.......’| [12-APR-2001 15:22:41] nspsend: 78 01 5D 01 26 01 00 3A |x.].&..:| [12-APR-2001 15:22:41] nspsend: 6D 01 00 44 02 0A 00 45 |m..D...E| [12-APR-2001 15:22:41] nspsend: 00 46 00 4A 00 4C 00 58 |.F.J.L.X| [12-APR-2001 15:22:41] nspsend: 00 5B 02 0A 00 5E 01 01 |.[...^..| [12-APR-2001 15:22:41] nspsend: 00 5F 17 01 00 60 60 01 |._...‘‘.| [12-APR-2001 15:22:41] nspsend: 00 61 60 01 00 64 00 65 |.a‘..d.e| [12-APR-2001 15:22:41] nspsend: 00 66 66 01 00 68 00 69 |.ff..h.i| [12-APR-2001 15:22:41] nspsend: 00 6A 6A 01 00 6C 6D 01 |.jj..lm.| [12-APR-2001 15:22:41] nspsend: 00 6D 6D 01 00 6E 6F 01 |.mm..no.| [12-APR-2001 15:22:41] nspsend: 00 6F 6F 01 00 70 70 01 |.oo..pp.| [12-APR-2001 15:22:41] nspsend: 00 71 71 01 00 72 72 01 |.qq..rr.| [12-APR-2001 15:22:41] nspsend: 00 73 73 01 00 74 66 01 |.ss..tf.| [12-APR-2001 15:22:41] nspsend: 00 76 00 77 00 79 6D 00 |.v.w.ym.| [12-APR-2001 15:22:41] nspsend: 00 7A 6D 00 00 7B 6D 00 |.zm..{m.| [12-APR-2001 15:22:41] nspsend: 00 88 00 92 92 01 00 93 |........| [12-APR-2001 15:22:41] nspsend: 93 01 00 98 02 0A 00 99 |........| [12-APR-2001 15:22:41] nspsend: 02 0A 00 9A 02 0A 00 9B |........| [12-APR-2001 15:22:41] nspsend: 01 01 00 9C 0C 0A 00 AC |........| [12-APR-2001 15:22:41] nspsend: 02 0A 00 B2 B2 01 00 B3 |........| [12-APR-2001 15:22:41] nspsend: B3 01 00 B4 B4 01 00 B5 |........| [12-APR-2001 15:22:41] nspsend: B5 01 00 B6 B6 01 00 B7 |........| [12-APR-2001 15:22:41] nspsend: B7 01 00 B8 0C 0A 00 B9 |........| [12-APR-2001 15:22:41] nspsend: B2 01 00 BA B3 01 00 BB |........| [12-APR-2001 15:22:41] nspsend: B4 01 00 BC B5 01 00 BD |........| [12-APR-2001 15:22:41] nspsend: B6 01 00 BE B7 01 00 BF |........| [12-APR-2001 15:22:41] nspsend: 00 C0 00 C3 70 01 00 C4 |....p...| [12-APR-2001 15:22:41] nspsend: 71 01 00 C5 72 01 00 D0 |q...r...| [12-APR-2001 15:22:41] nspsend: D0 01 00 D1 00 D4 00 D5 |........| [12-APR-2001 15:22:41] nspsend: 00 E7 E7 01 00 E8 E7 01 |........| [12-APR-2001 15:22:41] nspsend: 00 E9 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nsdofls: exit (0)

Page 41: Analyzing Net trace

Examining Oracle Net Trace Files Page - 40 April 12, 2001

[12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=85, *bl=0, *what=0, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdo: switching to application buffer [12-APR-2001 15:22:41] nsrdr: entry [12-APR-2001 15:22:41] nsrdr: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=905 [12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 905 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=905, plen=905, type=6 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 03 89 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 02 80 00 00 00 3C |.......<| [12-APR-2001 15:22:41] nsprecv: 3C 3C 80 00 00 00 01 01 |<<......| [12-APR-2001 15:22:41] nsprecv: 01 00 02 02 0A 00 08 08 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 0C 0C 0A 00 17 17 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 18 18 01 00 19 19 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 1A 1A 01 00 1B 1B |........| [12-APR-2001 15:22:41] nsprecv: 0A 00 1C 1C 01 00 1D 1D |........| [12-APR-2001 15:22:41] nsprecv: 01 00 1E 1E 01 00 1F 1F |........| [12-APR-2001 15:22:41] nsprecv: 01 00 20 20 0A 00 21 21 |.. ..!!| [12-APR-2001 15:22:41] nsprecv: 0A 00 0A 0A 01 00 0B 0B |........| [12-APR-2001 15:22:41] nsprecv: 01 00 22 22 01 00 23 23 |..""..##| [12-APR-2001 15:22:41] nsprecv: 01 00 24 24 01 00 25 25 |..$$..%%| [12-APR-2001 15:22:41] nsprecv: 01 00 26 26 01 00 28 28 |..&&..((| [12-APR-2001 15:22:41] nsprecv: 01 00 29 29 01 00 2A 2A |..))..**| [12-APR-2001 15:22:41] nsprecv: 01 00 2B 2B 01 00 2C 2C |..++..,,| [12-APR-2001 15:22:41] nsprecv: 01 00 2D 2D 01 00 2E 2E |..--....| [12-APR-2001 15:22:41] nsprecv: 01 00 2F 2F 01 00 30 30 |..//..00| [12-APR-2001 15:22:41] nsprecv: 01 00 31 31 01 00 32 32 |..11..22| [12-APR-2001 15:22:41] nsprecv: 01 00 33 33 01 00 34 34 |..33..44| [12-APR-2001 15:22:41] nsprecv: 01 00 35 35 01 00 36 36 |..55..66| [12-APR-2001 15:22:41] nsprecv: 01 00 37 37 01 00 38 38 |..77..88| [12-APR-2001 15:22:41] nsprecv: 01 00 39 39 01 00 3B 3B |..99..;;| [12-APR-2001 15:22:41] nsprecv: 01 00 3C 3C 01 00 3D 3D |..<<..==| [12-APR-2001 15:22:41] nsprecv: 01 00 3E 3E 01 00 3F 3F |..>>..??| [12-APR-2001 15:22:41] nsprecv: 01 00 40 40 01 00 41 41 |..@@..AA| [12-APR-2001 15:22:41] nsprecv: 01 00 42 42 01 00 43 43 |..BB..CC| [12-APR-2001 15:22:41] nsprecv: 01 00 47 47 01 00 48 48 |..GG..HH| [12-APR-2001 15:22:41] nsprecv: 01 00 49 49 01 00 4B 4B |..II..KK| [12-APR-2001 15:22:41] nsprecv: 01 00 4D 4D 01 00 4E 4E |..MM..NN| [12-APR-2001 15:22:41] nsprecv: 01 00 4F 4F 01 00 50 50 |..OO..PP| [12-APR-2001 15:22:41] nsprecv: 01 00 51 51 01 00 52 52 |..QQ..RR| [12-APR-2001 15:22:41] nsprecv: 01 00 53 53 01 00 54 54 |..SS..TT| [12-APR-2001 15:22:41] nsprecv: 01 00 55 55 01 00 56 56 |..UU..VV| [12-APR-2001 15:22:41] nsprecv: 01 00 57 57 01 00 59 59 |..WW..YY| [12-APR-2001 15:22:41] nsprecv: 01 00 5A 5A 01 00 5C 5C |..ZZ..\\| [12-APR-2001 15:22:41] nsprecv: 01 00 5D 5D 01 00 62 62 |..]]..bb| [12-APR-2001 15:22:41] nsprecv: 01 00 63 63 01 00 67 67 |..cc..gg| [12-APR-2001 15:22:41] nsprecv: 01 00 6B 6B 01 00 75 75 |..kk..uu| [12-APR-2001 15:22:41] nsprecv: 01 00 78 78 01 00 7C 7C |..xx..||| [12-APR-2001 15:22:41] nsprecv: 01 00 7D 7D 01 00 7E 7E |..}}..~~| [12-APR-2001 15:22:41] nsprecv: 01 00 7F 7F 01 00 80 80 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 81 81 01 00 82 82 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 83 83 01 00 84 84 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 85 85 01 00 86 86 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 87 87 01 00 89 89 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 8A 8A 01 00 8B 8B |........| [12-APR-2001 15:22:41] nsprecv: 01 00 8C 8C 01 00 8D 8D |........| [12-APR-2001 15:22:41] nsprecv: 01 00 8E 8E 01 00 8F 8F |........| [12-APR-2001 15:22:41] nsprecv: 01 00 90 90 01 00 91 91 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 94 94 01 00 95 95 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 96 96 01 00 97 97 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 9D 9D 01 00 9E 9E |........|

The server sends the client a character set and conversion graph it supports.

Page 42: Analyzing Net trace

Examining Oracle Net Trace Files Page - 41 April 12, 2001

[12-APR-2001 15:22:41] nsprecv: 01 00 9F 9F 01 00 A0 A0 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 A1 A1 01 00 A2 A2 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 A3 A3 01 00 A4 A4 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 A5 A5 01 00 A6 A6 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 A7 A7 01 00 A8 A8 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 A9 A9 01 00 AA AA |........| [12-APR-2001 15:22:41] nsprecv: 01 00 AB AB 01 00 AD AD |........| [12-APR-2001 15:22:41] nsprecv: 01 00 AE AE 01 00 AF AF |........| [12-APR-2001 15:22:41] nsprecv: 01 00 B0 B0 01 00 B1 B1 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 C1 C1 01 00 C2 C2 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 C6 C6 01 00 C7 C7 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 C8 C8 01 00 C9 C9 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 CA CA 01 00 CB CB |........| [12-APR-2001 15:22:41] nsprecv: 01 00 CC CC 01 00 CD CD |........| [12-APR-2001 15:22:41] nsprecv: 01 00 CE CE 01 00 CF CF |........| [12-APR-2001 15:22:41] nsprecv: 01 00 D2 D2 01 00 D3 D3 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 D6 D6 01 00 D7 D7 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 D8 D8 01 00 D9 D9 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 DA DA 01 00 DB DB |........| [12-APR-2001 15:22:41] nsprecv: 01 00 DC DC 01 00 DD DD |........| [12-APR-2001 15:22:41] nsprecv: 01 00 DE DE 01 00 DF DF |........| [12-APR-2001 15:22:41] nsprecv: 01 00 E0 E0 01 00 E1 E1 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 E2 E2 01 00 E3 E3 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 E4 E4 01 00 E5 E5 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 E6 E6 01 00 EA EA |........| [12-APR-2001 15:22:41] nsprecv: 01 00 03 02 0A 00 04 02 |........| [12-APR-2001 15:22:41] nsprecv: 0A 00 05 01 01 00 06 02 |........| [12-APR-2001 15:22:41] nsprecv: 0A 00 07 02 0A 00 09 01 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 0D 00 0E 00 0F 17 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 10 00 11 00 12 00 |........| [12-APR-2001 15:22:41] nsprecv: 13 00 14 00 15 00 16 00 |........| [12-APR-2001 15:22:41] nsprecv: 27 78 01 00 3A 6D 01 00 |’x..:m..| [12-APR-2001 15:22:41] nsprecv: 44 02 0A 00 45 00 46 00 |D...E.F.| [12-APR-2001 15:22:41] nsprecv: 4A 00 4C 00 58 00 5B 02 |J.L.X.[.| [12-APR-2001 15:22:41] nsprecv: 0A 00 5E 01 01 00 5F 17 |..^..._.| [12-APR-2001 15:22:41] nsprecv: 01 00 60 60 01 00 61 60 |..‘‘..a‘| [12-APR-2001 15:22:41] nsprecv: 01 00 64 00 65 00 66 66 |..d.e.ff| [12-APR-2001 15:22:41] nsprecv: 01 00 68 00 69 00 6A 6A |..h.i.jj| [12-APR-2001 15:22:41] nsprecv: 01 00 6C 6D 01 00 6D 6D |..lm..mm| [12-APR-2001 15:22:41] nsprecv: 01 00 6E 6F 01 00 6F 6F |..no..oo| [12-APR-2001 15:22:41] nsprecv: 01 00 70 70 01 00 71 71 |..pp..qq| [12-APR-2001 15:22:41] nsprecv: 01 00 72 72 01 00 73 73 |..rr..ss| [12-APR-2001 15:22:41] nsprecv: 01 00 74 66 01 00 76 00 |..tf..v.| [12-APR-2001 15:22:41] nsprecv: 77 00 79 6D 01 00 7A 6D |w.ym..zm| [12-APR-2001 15:22:41] nsprecv: 01 00 7B 6D 01 00 88 00 |..{m....| [12-APR-2001 15:22:41] nsprecv: 92 92 01 00 93 93 01 00 |........| [12-APR-2001 15:22:41] nsprecv: 98 02 0A 00 99 02 0A 00 |........| [12-APR-2001 15:22:41] nsprecv: 9A 02 0A 00 9B 01 01 00 |........| [12-APR-2001 15:22:41] nsprecv: 9C 0C 0A 00 AC 02 0A 00 |........| [12-APR-2001 15:22:41] nsprecv: B2 B2 01 00 B3 B3 01 00 |........| [12-APR-2001 15:22:41] nsprecv: B4 B4 01 00 B5 B5 01 00 |........| [12-APR-2001 15:22:41] nsprecv: B6 B6 01 00 B7 B7 01 00 |........| [12-APR-2001 15:22:41] nsprecv: B8 0C 0A 00 B9 B2 01 00 |........| [12-APR-2001 15:22:41] nsprecv: BA B3 01 00 BB B4 01 00 |........| [12-APR-2001 15:22:41] nsprecv: BC B5 01 00 BD B6 01 00 |........| [12-APR-2001 15:22:41] nsprecv: BE B7 01 00 BF 00 C0 00 |........| [12-APR-2001 15:22:41] nsprecv: C3 70 01 00 C4 71 01 00 |.p...q..| [12-APR-2001 15:22:41] nsprecv: C5 72 01 00 D0 D0 01 00 |.r......| [12-APR-2001 15:22:41] nsprecv: D1 00 D4 00 D5 00 E7 E7 |........| [12-APR-2001 15:22:41] nsprecv: 01 00 E8 E7 01 00 E9 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nsrdr: got NSPTDA packet [12-APR-2001 15:22:41] nsrdr: NSPTDA flags: 0x0 [12-APR-2001 15:22:41] nsrdr: normal exit [12-APR-2001 15:22:41] nsdo: *what=1, *bl=2038 [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nioqrc: exit

Page 43: Analyzing Net trace

Examining Oracle Net Trace Files Page - 42 April 12, 2001

Database Login [12-APR-2001 15:22:41] nioqsn: entry [12-APR-2001 15:22:41] nioqrc: entry [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=84, *bl=0, *what=1, uflgs=0x20, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdofls: entry [12-APR-2001 15:22:41] nsdofls: DATA flags: 0x0 [12-APR-2001 15:22:41] nsdofls: sending NSPTDA packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=162, type=6 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=162 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 162 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 00 A2 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 03 76 02 F4 FD 9D |...v....| [12-APR-2001 15:22:41] nspsend: 01 01 05 01 01 E0 D7 12 |........| [12-APR-2001 15:22:41] nspsend: 00 01 04 B0 D5 12 00 9C |........| [12-APR-2001 15:22:41] nspsend: D9 12 00 73 63 6F 74 74 |...scott| [12-APR-2001 15:22:41] nspsend: 01 0D 0D 41 55 54 48 5F |...AUTH_| [12-APR-2001 15:22:41] nspsend: 54 45 52 4D 49 4E 41 4C |TERMINAL| [12-APR-2001 15:22:41] nspsend: 01 0B 0B 4B 41 52 45 41 |...KAREA| [12-APR-2001 15:22:41] nspsend: 52 44 4F 2D 50 43 00 01 |RDO-PC..| [12-APR-2001 15:22:41] nspsend: 0F 0F 41 55 54 48 5F 50 |..AUTH_P| [12-APR-2001 15:22:41] nspsend: 52 4F 47 52 41 4D 5F 4E |ROGRAM_N| [12-APR-2001 15:22:41] nspsend: 4D 01 0C 0C 53 51 4C 50 |M...SQLP| [12-APR-2001 15:22:41] nspsend: 4C 55 53 57 2E 45 58 45 |LUSW.EXE| [12-APR-2001 15:22:41] nspsend: 00 01 0C 0C 41 55 54 48 |....AUTH| [12-APR-2001 15:22:41] nspsend: 5F 4D 41 43 48 49 4E 45 |_MACHINE| [12-APR-2001 15:22:41] nspsend: 01 10 10 43 4F 45 5C 4B |...COE\K| [12-APR-2001 15:22:41] nspsend: 41 52 45 41 52 44 4F 2D |AREARDO-| [12-APR-2001 15:22:41] nspsend: 50 43 00 00 01 08 08 41 |PC.....A| [12-APR-2001 15:22:41] nspsend: 55 54 48 5F 50 49 44 01 |UTH_PID.| [12-APR-2001 15:22:41] nspsend: 07 07 32 38 36 3A 33 31 |..286:31| [12-APR-2001 15:22:41] nspsend: 38 00 00 00 00 00 00 00 |8.......| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nsdofls: exit (0) [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=85, *bl=0, *what=0, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdo: switching to application buffer [12-APR-2001 15:22:41] nsrdr: entry [12-APR-2001 15:22:41] nsrdr: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=75 [12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 75 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=75, plen=75, type=6 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 00 4B 00 00 06 00 00 00 |.K......| [12-APR-2001 15:22:41] nsprecv: 00 00 08 01 01 01 0C 0C |........| [12-APR-2001 15:22:41] nsprecv: 41 55 54 48 5F 53 45 53 |AUTH_SES| [12-APR-2001 15:22:41] nsprecv: 53 4B 45 59 01 10 10 41 |SKEY...A| [12-APR-2001 15:22:41] nsprecv: 37 34 46 39 30 31 39 42 |74F9019B| [12-APR-2001 15:22:41] nsprecv: 44 32 43 35 37 30 38 00 |D2C5708.| [12-APR-2001 15:22:41] nsprecv: 04 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 40 00 00 00 00 00 00 |.@......| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 02 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit

The client and server have informed each other of their operating systems, Oracle Net versions, respective character sets, and security algorithms. Logging into the database is next. Oracle performs this step in two parts. This process varies depending if it is SQL*Plus or the Oracle Call Interface. The following is from SQL*Plus and it is making a request to get a session key.

The first part of the login is accepted and the server responds by returning the session key.

Page 44: Analyzing Net trace

Examining Oracle Net Trace Files Page - 43 April 12, 2001

[12-APR-2001 15:22:41] nsrdr: got NSPTDA packet [12-APR-2001 15:22:41] nsrdr: NSPTDA flags: 0x0 [12-APR-2001 15:22:41] nsrdr: normal exit [12-APR-2001 15:22:41] nsdo: *what=1, *bl=2009 [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nioqrc: exit [12-APR-2001 15:22:41] nioqsn: entry [12-APR-2001 15:22:41] nioqrc: entry [12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=84, *bl=0, *what=1, uflgs=0x20, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdofls: entry [12-APR-2001 15:22:41] nsdofls: DATA flags: 0x0 [12-APR-2001 15:22:41] nsdofls: sending NSPTDA packet [12-APR-2001 15:22:41] nspsend: entry [12-APR-2001 15:22:41] nspsend: plen=738, type=6 [12-APR-2001 15:22:41] nttwr: entry [12-APR-2001 15:22:41] nttwr: socket 156 had bytes written=738 [12-APR-2001 15:22:41] nttwr: exit [12-APR-2001 15:22:41] nspsend: 738 bytes to transport [12-APR-2001 15:22:41] nspsend: packet dump [12-APR-2001 15:22:41] nspsend: 02 E2 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: 00 00 03 73 03 F4 FD 9D |...s....| [12-APR-2001 15:22:41] nspsend: 01 01 05 02 01 01 A4 E3 |........| [12-APR-2001 15:22:41] nspsend: 12 00 01 07 10 E0 12 00 |........| [12-APR-2001 15:22:41] nspsend: C0 E5 12 00 73 63 6F 74 |....scot| [12-APR-2001 15:22:41] nspsend: 74 01 0D 0D 41 55 54 48 |t...AUTH| [12-APR-2001 15:22:41] nspsend: 5F 50 41 53 53 57 4F 52 |_PASSWOR| [12-APR-2001 15:22:41] nspsend: 44 01 11 11 32 31 44 46 |D...21DF| [12-APR-2001 15:22:41] nspsend: 37 43 34 42 39 46 45 33 |7C4B9FE3| [12-APR-2001 15:22:41] nspsend: 32 33 39 41 33 00 01 0D |239A3...| [12-APR-2001 15:22:41] nspsend: 0D 41 55 54 48 5F 54 45 |.AUTH_TE| [12-APR-2001 15:22:41] nspsend: 52 4D 49 4E 41 4C 01 0B |RMINAL..| [12-APR-2001 15:22:41] nspsend: 0B 4B 41 52 45 41 52 44 |.KAREARD| [12-APR-2001 15:22:41] nspsend: 4F 2D 50 43 00 01 0F 0F |O-PC....| [12-APR-2001 15:22:41] nspsend: 41 55 54 48 5F 50 52 4F |AUTH_PRO| [12-APR-2001 15:22:41] nspsend: 47 52 41 4D 5F 4E 4D 01 |GRAM_NM.| [12-APR-2001 15:22:41] nspsend: 0C 0C 53 51 4C 50 4C 55 |..SQLPLU| [12-APR-2001 15:22:41] nspsend: 53 57 2E 45 58 45 00 01 |SW.EXE..| [12-APR-2001 15:22:41] nspsend: 0C 0C 41 55 54 48 5F 4D |..AUTH_M| [12-APR-2001 15:22:41] nspsend: 41 43 48 49 4E 45 01 10 |ACHINE..| [12-APR-2001 15:22:41] nspsend: 10 43 4F 45 5C 4B 41 52 |.COE\KAR| [12-APR-2001 15:22:41] nspsend: 45 41 52 44 4F 2D 50 43 |EARDO-PC| [12-APR-2001 15:22:41] nspsend: 00 00 01 08 08 41 55 54 |.....AUT| [12-APR-2001 15:22:41] nspsend: 48 5F 50 49 44 01 07 07 |H_PID...| [12-APR-2001 15:22:41] nspsend: 32 38 36 3A 33 31 38 00 |286:318.| [12-APR-2001 15:22:41] nspsend: 01 08 08 41 55 54 48 5F |...AUTH_| [12-APR-2001 15:22:41] nspsend: 41 43 4C 01 04 04 34 30 |ACL...40| [12-APR-2001 15:22:41] nspsend: 30 30 00 01 12 12 41 55 |00....AU| [12-APR-2001 15:22:41] nspsend: 54 48 5F 41 4C 54 45 52 |TH_ALTER| [12-APR-2001 15:22:41] nspsend: 5F 53 45 53 53 49 4F 4E |_SESSION| [12-APR-2001 15:22:41] nspsend: 02 01 E4 FE 40 41 4C 54 |....@ALT| [12-APR-2001 15:22:41] nspsend: 45 52 20 53 45 53 53 49 |ER SESSI| [12-APR-2001 15:22:41] nspsend: 4F 4E 20 53 45 54 20 4E |ON SET N| [12-APR-2001 15:22:41] nspsend: 4C 53 5F 4C 41 4E 47 55 |LS_LANGU| [12-APR-2001 15:22:41] nspsend: 41 47 45 3D 20 27 41 4D |AGE= ’AM| [12-APR-2001 15:22:41] nspsend: 45 52 49 43 41 4E 27 20 |ERICAN’ | [12-APR-2001 15:22:41] nspsend: 4E 4C 53 5F 54 45 52 52 |NLS_TERR| [12-APR-2001 15:22:41] nspsend: 49 54 4F 52 59 3D 20 27 |ITORY= ’| [12-APR-2001 15:22:41] nspsend: 41 4D 45 52 49 40 43 41 |AMERI@CA| [12-APR-2001 15:22:41] nspsend: 27 20 4E 4C 53 5F 43 55 |’ NLS_CU| [12-APR-2001 15:22:41] nspsend: 52 52 45 4E 43 59 3D 20 |RRENCY= | [12-APR-2001 15:22:41] nspsend: 27 24 27 20 4E 4C 53 5F |’$’ NLS_| [12-APR-2001 15:22:41] nspsend: 49 53 4F 5F 43 55 52 52 |ISO_CURR| [12-APR-2001 15:22:41] nspsend: 45 4E 43 59 3D 20 27 41 |ENCY= ’A| [12-APR-2001 15:22:41] nspsend: 4D 45 52 49 43 41 27 20 |MERICA’ | [12-APR-2001 15:22:41] nspsend: 4E 4C 53 5F 4E 55 4D 45 |NLS_NUME| [12-APR-2001 15:22:41] nspsend: 52 49 43 5F 43 48 40 41 |RIC_CH@A|

The client completes the login by sending the full login information including the encrypted password and issues an alter session SQL command to further set the NLS environment in the database session.

Page 45: Analyzing Net trace

Examining Oracle Net Trace Files Page - 44 April 12, 2001

[12-APR-2001 15:22:41] nspsend: 52 41 43 54 45 52 53 3D |RACTERS=| [12-APR-2001 15:22:41] nspsend: 20 27 2E 2C 27 20 4E 4C | ’.,’ NL| [12-APR-2001 15:22:41] nspsend: 53 5F 43 41 4C 45 4E 44 |S_CALEND| [12-APR-2001 15:22:41] nspsend: 41 52 3D 20 27 47 52 45 |AR= ’GRE| [12-APR-2001 15:22:41] nspsend: 47 4F 52 49 41 4E 27 20 |GORIAN’ | [12-APR-2001 15:22:41] nspsend: 4E 4C 53 5F 44 41 54 45 |NLS_DATE| [12-APR-2001 15:22:41] nspsend: 5F 46 4F 52 4D 41 54 3D |_FORMAT=| [12-APR-2001 15:22:41] nspsend: 20 27 44 44 2D 4D 4F 40 | ’DD-MO@| [12-APR-2001 15:22:41] nspsend: 4E 2D 52 52 27 20 4E 4C |N-RR’ NL| [12-APR-2001 15:22:41] nspsend: 53 5F 44 41 54 45 5F 4C |S_DATE_L| [12-APR-2001 15:22:41] nspsend: 41 4E 47 55 41 47 45 3D |ANGUAGE=| [12-APR-2001 15:22:41] nspsend: 20 27 41 4D 45 52 49 43 | ’AMERIC| [12-APR-2001 15:22:41] nspsend: 41 4E 27 20 20 4E 4C 53 |AN’ NLS| [12-APR-2001 15:22:41] nspsend: 5F 53 4F 52 54 3D 20 27 |_SORT= ’| [12-APR-2001 15:22:41] nspsend: 42 49 4E 41 52 59 27 20 |BINARY’ | [12-APR-2001 15:22:41] nspsend: 54 49 4D 45 5F 5A 4F 4E |TIME_ZON| [12-APR-2001 15:22:41] nspsend: 40 45 3D 20 27 2D 30 37 |@E= ’-07| [12-APR-2001 15:22:41] nspsend: 3A 30 30 27 20 4E 4C 53 |:00’ NLS| [12-APR-2001 15:22:41] nspsend: 5F 44 55 41 4C 5F 43 55 |_DUAL_CU| [12-APR-2001 15:22:41] nspsend: 52 52 45 4E 43 59 20 3D |RRENCY =| [12-APR-2001 15:22:41] nspsend: 20 27 24 27 20 4E 4C 53 | ’$’ NLS| [12-APR-2001 15:22:41] nspsend: 5F 54 49 4D 45 5F 46 4F |_TIME_FO| [12-APR-2001 15:22:41] nspsend: 52 4D 41 54 20 3D 20 27 |RMAT = ’| [12-APR-2001 15:22:41] nspsend: 48 48 2E 4D 49 2E 53 53 |HH.MI.SS| [12-APR-2001 15:22:41] nspsend: 58 40 46 46 20 41 4D 27 |X@FF AM’| [12-APR-2001 15:22:41] nspsend: 20 4E 4C 53 5F 54 49 4D | NLS_TIM| [12-APR-2001 15:22:41] nspsend: 45 53 54 41 4D 50 5F 46 |ESTAMP_F| [12-APR-2001 15:22:41] nspsend: 4F 52 4D 41 54 20 3D 20 |ORMAT = | [12-APR-2001 15:22:41] nspsend: 27 44 44 2D 4D 4F 4E 2D |’DD-MON-| [12-APR-2001 15:22:41] nspsend: 52 52 20 48 48 2E 4D 49 |RR HH.MI| [12-APR-2001 15:22:41] nspsend: 2E 53 53 58 46 46 20 41 |.SSXFF A| [12-APR-2001 15:22:41] nspsend: 4D 27 20 4E 4C 53 5F 54 |M’ NLS_T| [12-APR-2001 15:22:41] nspsend: 49 4D 40 45 5F 54 5A 5F |IM@E_TZ_| [12-APR-2001 15:22:41] nspsend: 46 4F 52 4D 41 54 20 3D |FORMAT =| [12-APR-2001 15:22:41] nspsend: 20 27 48 48 2E 4D 49 2E | ’HH.MI.| [12-APR-2001 15:22:41] nspsend: 53 53 58 46 46 20 41 4D |SSXFF AM| [12-APR-2001 15:22:41] nspsend: 20 54 5A 48 3A 54 5A 4D | TZH:TZM| [12-APR-2001 15:22:41] nspsend: 27 20 4E 4C 53 5F 54 49 |’ NLS_TI| [12-APR-2001 15:22:41] nspsend: 4D 45 53 54 41 4D 50 5F |MESTAMP_| [12-APR-2001 15:22:41] nspsend: 54 5A 5F 46 4F 52 4D 41 |TZ_FORMA| [12-APR-2001 15:22:41] nspsend: 54 20 3D 24 20 27 44 44 |T =$ ’DD| [12-APR-2001 15:22:41] nspsend: 2D 4D 4F 4E 2D 52 52 20 |-MON-RR | [12-APR-2001 15:22:41] nspsend: 48 48 2E 4D 49 2E 53 53 |HH.MI.SS| [12-APR-2001 15:22:41] nspsend: 58 46 46 20 41 4D 20 54 |XFF AM T| [12-APR-2001 15:22:41] nspsend: 5A 48 3A 54 5A 4D 27 00 |ZH:TZM’.| [12-APR-2001 15:22:41] nspsend: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nspsend: normal exit [12-APR-2001 15:22:41] nsdofls: exit (0) [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit

Page 46: Analyzing Net trace

Examining Oracle Net Trace Files Page - 45 April 12, 2001

[12-APR-2001 15:22:41] nsdo: entry [12-APR-2001 15:22:41] nsdo: cid=0, opcode=85, *bl=0, *what=0, uflgs=0x0, cflgs=0x3 [12-APR-2001 15:22:41] nsdo: rank=64, nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: nsctx: state=8, flg=0x420d, mvd=0 [12-APR-2001 15:22:41] nsdo: gtn=127, gtc=127, ptn=10, ptc=2019 [12-APR-2001 15:22:41] nsdo: switching to application buffer [12-APR-2001 15:22:41] nsrdr: entry [12-APR-2001 15:22:41] nsrdr: recving a packet [12-APR-2001 15:22:41] nsprecv: entry [12-APR-2001 15:22:41] nsprecv: reading from transport... [12-APR-2001 15:22:41] nttrd: entry [12-APR-2001 15:22:41] nttrd: socket 156 had bytes read=261 [12-APR-2001 15:22:41] nttrd: exit [12-APR-2001 15:22:41] nsprecv: 261 bytes from transport [12-APR-2001 15:22:41] nsprecv: tlen=261, plen=261, type=6 [12-APR-2001 15:22:41] nsprecv: packet dump [12-APR-2001 15:22:41] nsprecv: 01 05 00 00 06 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 08 01 08 01 13 13 |........| [12-APR-2001 15:22:41] nsprecv: 41 55 54 48 5F 56 45 52 |AUTH_VER| [12-APR-2001 15:22:41] nsprecv: 53 49 4F 4E 5F 53 54 52 |SION_STR| [12-APR-2001 15:22:41] nsprecv: 49 4E 47 01 0C 0C 2D 20 |ING...- | [12-APR-2001 15:22:41] nsprecv: 50 72 6F 64 75 63 74 69 |Producti| [12-APR-2001 15:22:41] nsprecv: 6F 6E 00 01 10 10 41 55 |on....AU| [12-APR-2001 15:22:41] nsprecv: 54 48 5F 56 45 52 53 49 |TH_VERSI| [12-APR-2001 15:22:41] nsprecv: 4F 4E 5F 53 51 4C 01 02 |ON_SQL..| [12-APR-2001 15:22:41] nsprecv: 02 31 34 00 01 13 13 41 |.14....A| [12-APR-2001 15:22:41] nsprecv: 55 54 48 5F 58 41 43 54 |UTH_XACT| [12-APR-2001 15:22:41] nsprecv: 49 4F 4E 5F 54 52 41 49 |ION_TRAI| [12-APR-2001 15:22:41] nsprecv: 54 53 01 01 01 33 00 01 |TS...3..| [12-APR-2001 15:22:41] nsprecv: 0F 0F 41 55 54 48 5F 56 |..AUTH_V| [12-APR-2001 15:22:41] nsprecv: 45 52 53 49 4F 4E 5F 4E |ERSION_N| [12-APR-2001 15:22:41] nsprecv: 4F 01 09 09 31 33 35 32 |O...1352| [12-APR-2001 15:22:41] nsprecv: 39 34 39 37 36 00 01 13 |94976...| [12-APR-2001 15:22:41] nsprecv: 13 41 55 54 48 5F 56 45 |.AUTH_VE| [12-APR-2001 15:22:41] nsprecv: 52 53 49 4F 4E 5F 53 54 |RSION_ST| [12-APR-2001 15:22:41] nsprecv: 41 54 55 53 01 01 01 30 |ATUS...0| [12-APR-2001 15:22:41] nsprecv: 00 01 15 15 41 55 54 48 |....AUTH| [12-APR-2001 15:22:41] nsprecv: 5F 43 41 50 41 42 49 4C |_CAPABIL| [12-APR-2001 15:22:41] nsprecv: 49 54 59 5F 54 41 42 4C |ITY_TABL| [12-APR-2001 15:22:41] nsprecv: 45 00 00 01 0F 0F 41 55 |E.....AU| [12-APR-2001 15:22:41] nsprecv: 54 48 5F 53 45 53 53 49 |TH_SESSI| [12-APR-2001 15:22:41] nsprecv: 4F 4E 5F 49 44 01 02 02 |ON_ID...| [12-APR-2001 15:22:41] nsprecv: 31 31 00 01 0F 0F 41 55 |11....AU| [12-APR-2001 15:22:41] nsprecv: 54 48 5F 53 45 52 49 41 |TH_SERIA| [12-APR-2001 15:22:41] nsprecv: 4C 5F 4E 55 4D 01 01 01 |L_NUM...| [12-APR-2001 15:22:41] nsprecv: 36 00 04 00 00 00 00 00 |6.......| [12-APR-2001 15:22:41] nsprecv: 00 00 00 40 00 00 00 00 |...@....| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 03 00 |........| [12-APR-2001 15:22:41] nsprecv: 00 00 00 00 00 00 00 00 |........| [12-APR-2001 15:22:41] nsprecv: normal exit [12-APR-2001 15:22:41] nsrdr: got NSPTDA packet [12-APR-2001 15:22:41] nsrdr: NSPTDA flags: 0x0 [12-APR-2001 15:22:41] nsrdr: normal exit [12-APR-2001 15:22:41] nsdo: *what=1, *bl=2038 [12-APR-2001 15:22:41] nsdo: nsctxrnk=0 [12-APR-2001 15:22:41] nsdo: normal exit [12-APR-2001 15:22:41] nioqrc: exit [12-APR-2001 15:22:41] nszssk: entry [12-APR-2001 15:22:41] nassky: entry [12-APR-2001 15:22:41] nassky: exit [12-APR-2001 15:22:41] nszssk: exit

At this point the client is logged into the database. Many of the parameters sent to the database server process as part of the logon process are visible from the database V$SESSION view. What follows from here is all NSPTDA (data) packets further setting up the client’s database session. For the purposes of this paper, the trace is ended here.

The server accepts the second part of the login, which includes various parameters, authorizing the session and user.

Page 47: Analyzing Net trace

Examining Oracle Net Trace Files Page - 46 April 12, 2001

Summary Oracle Net trace analysis can be a good source of information when having to resolve the complex problems arising in computing environments using Oracle software. By covering the initial connect and login to the Oracle database from the client perspective, this paper presented several keys for understanding Oracle Net trace files. This paper illustrated the layer and component structure of Oracle Net. It revealed how to understand the cryptic lines in the trace file by pointing out the various layers and procedures used. It pointed out the importance that analyzing the trace files in the proper context can find both labeled and unlabeled errors (as shown in the example of the LDAP server). Also explained was the order of the packet traversal for connections and the various packets used. Trace files provide an accurate view of Oracle Net activity and the activity between the client and the database. With an understanding of Oracle Net components and a careful reading of the messages in the trace files, the reader should be able to analyze Oracle Net connections and find the source of many problems. It takes practice, but the more trace files read, the easier they become to understand and use.