packet capture

# rsh filer pktt start e8
# rsh filer pktt pause e8
# rsh filer pktt dump e8
# rsh filer pktt stop e8

The resulting .trc file ends up on /vol/vol0 on the filer.

Option:

# rsh filer pktt start e8 -b 5000000

This uses 5000000 bytes for the buffer instead of the default (which rarely captures more than 800 packets in its default size). The documentation I found on the web tries to frighten you into limiting this to 1Mb or smaller, but I've done successfull captures with the 5Mb setting above.