tcptrace(1)
NAME
tcptrace - a TCP connection analysis tool
SYNOPSIS
tcptrace [options] filename
DESCRIPTION
tcptrace takes a tcpdump file specified on the command line (or from standard input) and produces a summarization of the connections.
OPTIONS
Output format options
-b brief output format
-l long output format
-r print rtt statistics (slower for large files)
-W report on estimated congestion window (not generally useful)
-q no output (if you just want modules output)
Graphing options
-T create throughput graph[s], (average over 10 segments, see -A)
-R create rtt sample graph[s]
-S create time sequence graph[s]
-N create owin graph[s] (_o_utstanding data on _N_etwork)
-F create segsize graph[s]
-G create ALL graphs
Output format detail options
-D print in decimal
-X print in hexadecimal
-n don't resolve host or service names (much faster)
-s use short names (list "picard.cs.ohiou.edu" as just "picard")
Connection filtering options
-iN ignore connection N (can use multiple times)
-oN[-M]
only connection N (or N through M). Arg can be used many times.
In N is a file rather than a number, read list from file instead.
-c ignore non-complete connections (didn't see syn's and fin's)
-BN first segment number to analyze (default 1)
-EN last segment number to analyze (default last in file)
Graphing detail options
-C produce color plot[s]
-M produce monochrome (b/w) plot[s]
-AN Average N segments for throughput graphs, default is 10
-z zero axis options:
-z plot time axis from 0 rather than wall clock time (backward
compat)
-zx plot time axis from 0 rather than wall clock time
-zy plot sequence numbers from 0 (time sequence graphs only)
-zxy plot both axes from 0
-y omit the (yellow) instantaneous throughput points in tput graph
Misc options
-Z dump raw rtt sample times to file[s]
-p print all packet contents (can be very long)
-P print packet contents for selected connections
-t tick' off the packet numbers as a progress indication
-v print version information and exit
-w print various warning messages
-d whistle while you work (enable debug, use -d -d for more output)
-e extract contents of each TCP stream into file
-h print help messages
-u print minimal UDP information too
-Ofile
dump matched packets to tcpdump file 'file'
+[v] reverse the setting of the -[v] flag (for booleans)
Extended boolean options (unambiguous prefixes also work)
--showsacks
show SACK blocks on time sequence graphs (default)
--noshowsacks
DON'T show SACK blocks on time sequence graphs
--showrexmit
mark retransmits on time sequence graphs (default)
--noshowrexmit
DON'T mark retransmits on time sequence graphs
--showoutorder
mark out-of-order on time sequence graphs (default)
--noshowoutorder
DON'T mark out-of-order on time sequence graphs
--showzerowindow
mark zero windows on time sequence graphs (default)
--noshowzerowindow
DON'T mark zero windows on time sequence graphs
--showurg
mark packets with URGENT bit set on the time sequence graphs
(default)
--noshowurg
DON'T mark packets with URGENT bit set on the time sequence graphs
--showrttdongles
mark non-RTT-generating ACKs with special symbols
--noshowrttdongles
DON'T mark non-RTT-generating ACKs with special symbols (default)
--showdupack3
mark triple dupacks on time sequence graphs (default)
--noshowdupack3
DON'T mark triple dupacks on time sequence graphs
--showzerolensegs
show zero length packets on time sequence graphs (default)
--noshowzerolensegs
DON'T show zero length packets on time sequence graphs
--showzwndprobes
show zero window probe packets on time sequence graphs (default)
--noshowzwndprobes
DON'T show zero window probe packets on time sequence graphs
--showtitle
show title on the graphs (default)
--noshowtitle
DON'T show title on the graphs
--res_addr
resolve IP addresses into names (may be slow) (default)
--nores_addr
DON'T resolve IP addresses into names (may be slow)
--res_port
resolve port numbers into names (default)
--nores_port
DON'T resolve port numbers into names
--checksum
verify IP and TCP checksums
--nochecksum
DON'T verify IP and TCP checksums (default)
--dupack3_data
count a duplicate ACK carrying data as a triple dupack
--nodupack3_data
DON'T count a duplicate ACK carrying data as a triple dupack
(default)
--check_hwdups
check for 'hardware' dups (default)
--nocheck_hwdups
DON'T check for 'hardware' dups
--warn_ooo
print warnings when packets timestamps are out of order
--nowarn_ooo
DON'T print warnings when packets timestamps are out of order
(default)
--warn_printtrunc
print warnings when packets are too short to analyze
--nowarn_printtrunc
DON'T print warnings when packets are too short to analyze
(default)
--warn_printbadmbz
print warnings when MustBeZero TCP fields are NOT 0
--nowarn_printbadmbz
DON'T print warnings when MustBeZero TCP fields are NOT 0
(default)
--warn_printhwdups
print warnings for hardware duplicates
--nowarn_printhwdups
DON'T print warnings for hardware duplicates (default)
--warn_printbadcsum
print warnings when packets with bad checksums
--nowarn_printbadcsum
DON'T print warnings when packets with bad checksums (default)
--warn_printbad_syn_fin_seq
print warnings when SYNs or FINs rexmitted with different sequence
numbers
--nowarn_printbad_syn_fin_seq
DON'T print warnings when SYNs or FINs rexmitted with different
sequence numbers (default)
--dump_packet_data
print all packets AND dump the TCP/UDP data
--nodump_packet_data
DON'T print all packets AND dump the TCP/UDP data (default)
--continuous
run continuously and don't provide a summary
--nocontinuous
DON'T run continuously and don't provide a summary (default)
--print_seq_zero
print sequence numbers as offset from initial sequence number
--noprint_seq_zero
DON'T print sequence numbers as offset from initial sequence
number (default)
--limit_conn_num
limit the maximum number of connections kept at a time in real-
time mode
--nolimit_conn_num
DON'T limit the maximum number of connections kept at a time in
real-time mode (default)
--xplot_all_files
display all generated xplot files at the end
--noxplot_all_files
DON'T display all generated xplot files at the end (default)
--ns_hdrs
assume that ns has the useHeaders_flag true (uses IP+TCP headers)
(default)
--nons_hdrs
DON'T assume that ns has the useHeaders_flag true (uses IP+TCP
headers)
--csv
display the long output as comma separated values
--nocsv
DON'T display the long output as comma separated values (default)
--tsv
display the long output as tab separated values
--notsv
DON'T display the long output as tab separated values (default)
Extended variable options (unambiguous prefixes also work)
--output_dir=``STR''
directory where all output files are placed (default: '<NULL>')
--output_prefix=``STR''
prefix all output files with this string (default: '<NULL>')
--xplot_title_prefix=``STR''
prefix to place in the titles of all xplot files (default:
'<NULL>')
--update_interval=``STR''
time interval for updates in real-time mode (default: '<NULL>')
--max_conn_num=``STR''
maximum number of connections to keep at a time in real-time mode
(default: '<NULL>')
--remove_live_conn_interval=``STR''
idle time after which an open connection is removed in real-time
mode (default: '<NULL>')
--remove_closed_conn_interval=``STR''
time interval after which a closed connection is removed in real-
time mode (default: '<NULL>')
--xplot_args=``STR''
arguments to pass to xplot, if we are calling xplot from here
(default: '<NULL>')
--sv=``STR''
separator to use for long output with <STR>-separated-values
(default: '<NULL>')
Included Modules
http Http analysis package
tcplib TCPLib analysis package
traffic traffic analysis package
slice traffic efficiency data by time slices
rttgraph round trip time analysis graphs
collie connection summary package
realtime example real-time package
For module-specific options, please use `tcptrace -hxargs`
Filter Variables:
Please use 'tcptrace -hfilter' for the complete listing of filter
variables.
Filter Syntax:
Please use 'tcptrace -hfilter' for filter syntax.
ENVIRONMENT
Options are first read from the file $HOME/.tcptracerc (if it exists), and then from the environment variable TCPTRACEOPTS (if it exists), and finally from the command line.
AUTHOR
Shawn Ostermann (ostermann@cs.ohiou.edu)
CREDITS
Thanks to Mark Foster (mafoster@george.arc.nasa.gov) for writing this manual page. Thanks to Avinash Lakhiani (alakhian@irg.cs.ohiou.edu) for updating it.
FILES
Dump File Names Trailing (unrecognized) arguments are taken to be one or more filenames. The files can be compressed, see compress.h for configuration. If the dump file name is 'stdin', then we read from standard input rather than from a file.
SEE ALSO
xplot an interactive tool for examining .xpl files output by
tcptrace.
jPlot a Java version of xplot.
14 Oct 2002 tcptrace(1)
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
