Kernel Lock Manager Protocol (KLM)
The KLM protocol is used, in some operating systems, to manage lock requests between the NFS client kernel of a NFS host and the user space lock manager daemon. This protocol is only used across the loopback interface and will never be seen on a network.
XXX - Add example traffic here as plain text or Wireshark screenshot).
The KLM dissector is fully functional.
There are no preferences for the KLM protocol itself, but since it shares the filehandle structure with NFS there are some NFS preferences related to filehandles that do affect the dissection of KLM.
Example capture file
A complete list of KLM display filter fields can be found in the display filter reference
Show only the KLM based traffic:
You cannot directly filter KLM while capturing. However, if you know the UDP port used (see above), you can filter on that one. KLM only exists ontop of the loopback interface so one can only capture KLM on a host that allows capturing of loopback.
A KLM specification does not exist, however most unixen do have an interface specification for the protocol in /usr/include/rpcsvc