Description of TRF2TCPD

Download count: 2 this month, 4303 altogether.
Downloads for TRF2TCPD:
  VMARC archive: v-4K

From Rob van der Heij, IBM Netherlands

Since z/VM 4.4 the VM TCP/IP stack can produce a packet trace that is recorded in TRF files. The TRF2TCPD utility reads the TRF files and converts the contents to the format used by Linux tcpdump command. The tcpdump format (actually the libpcap format) is used by most Linux tools that show or analyse recorded packet traces (like tcpdump, tcptrace). Because the TRF2TCPD utility reads the TRF files, there is no need to run TRACERED and buffer the output of that somewhere on disk.

You need at least CMS Pipelines 1.0111 sublevel B (May 2004) to run this program. The latest version of the CMS Pipelines Runtime Library can be downloaded from the CMS Pipelines Homepage at
Only the userid running this conversion program needs to have the new level of CMS Pipelines available. You do not have to install that level for all other users if you do not want to do so. In that case, it would be sufficient to download the PIPELINE MODULE from the CMS Pipelines Homepage and store it as NXPIPE MODULE on an accessed disk. Using the PICKPIPE utility (also from the CMS Pipelines Homepage) you can select the new level with


To convert one or more TRF files into tcpdump format, use the following:
Usage: TRF2TCPD spids fn ft fm


list of TRF spool file id's, separated by comma
fn ft fm
output file to be written

The output file must then be transferred in binary (e.g. via FTP) to a Linux system where the tcpdump command could be used to display a formatted trace:

tcpdump -rn <fn.ft> The tcpdump (and libpcap) are probably part of your Linux distribution. Another useful tool is tcptrace from You may also find tools like WinDump providing such function on a Windows workstation.