All Products
Document Center

Ocs-sniffer tool

Last Updated: May 31, 2020

To help you better troubleshoot slow accesses to Memecache, we offers ocs-sniffer to analyze and locate the problem. The tool is easier to get started and for viewing the results than Tcpdump.

Click to Download

Ocs-sniffer tool can be used to capture packets online for analysis (or to analyze the packets captured by Tcpdump offline). It currently supports Memcached protocol and HTTP protocol.

Steps of use

  1. Ocs_sniffer tool requires the sudo permission to be executed.

    1. Usage: ./ocs_sniffer -f conf_file [-i device] [-r pcap file] [-d debug_level] [-vh]
    2. -i: interface to sniff
    3. -f: configure file
    4. -d: debug level; default is 8
    5. -h: show help message
    6. -r: read packets from tcpdump offline file
    7. -v: verbose mode, show all debug messages and verbose log
  2. A configuration file is required for using the tool (see the ocs_sniffer.conf.default in the appendix for the template).

    In the configuration file:

    1. ipnet: to configure the IP address of the server for capturing packets (because sometimes the analysis is performed offline on another server, an IP address is required here)
    2. sniff_port: to configure the port for packet capturing, such as 11211 for Memcached
    3. iface: NIC name
    4. pktlog: the storage log of the captured packages. It can be stored to a file (file:log_path. Attention: automatic recursion is not supported for directory creation) or output to the terminal (console:)
    5. errlog: the log of errors
    6. log_buffer_size: the size of log cache (Unit: KB). Only when the cache is full or when the application is exited will the log be output. If it is set to 0, the cache will be closed.
  3. Analyze the packet capturing results.

    Results in the normal mode

    1. [MEMCACHED] [Session Initiation Time] [Opposite IP Address.Opposite Port] [Packet Capturing IP Address.Packet Capturing Port] [Request] [Response] [Request Key] [Request Value] [Request Cas] [Response Key] [Response Value] [Response Cas] [RT] [Server Processing Time] [Round Trip Time]


  • If the field doesn’t exist in the packet, it will not be output;

  • The invisible characters in key and value will be replaced by period (.);

  • The unit of RT, Server Processing Time and Round Trip Time is ms.