snoop and NFS
By user12625760 on Jan 03, 2006
Well here is a thing I never knew until today. If you want to snoop all the NFS traffic between two hosts then don't use the rpc option. Ie don't do this:
snoop rpc nfs
As this will only collect you the packets that contain the RPC headers in them not all the other packets with the ACK's and the packets that contain the majority of the data. For NFS use
snoop port nfsd
which will get you everything on the nfs port including all those extra packets you really really want to see.