When tcptrace is run trivially on a dumpfile, it generates output similar to the following :
Beluga:/Users/mani> tcptrace tigris.dmp 1 arg remaining, starting with 'tigris.dmp' Ostermann's tcptrace -- version 6.4.5 -- Fri Jun 13, 2003 87 packets seen, 87 TCP packets traced elapsed wallclock time: 0:00:00.037900, 2295 pkts/sec analyzed trace file elapsed time: 0:00:12.180796 TCP connection info: 1: pride.cs.ohiou.edu:54735 - elephus.cs.ohiou.edu:ssh (a2b) 30> 30< (complete) 2: pride.cs.ohiou.edu:54736 - a17-112-152-32.apple.com:http (c2d) 12> 15< (complete)
In the above example, tcptrace is run on dumpfile tigris.dmp. The initial lines tell that the file tcptrace is processing currently is tigris.dmp, the version of tcptrace running, and when it was compiled. The next line tells that a total of 87 packets were seen in the dumpfile and all the 87 TCP packets (in this case) were traced. The next line tells that the elapsed wallclock time i.e., the time tcptrace took to process the dumpfile, and the average speed in packets per second taken for processing. The following line indicates the trace file elapsed time i.e., the duration of packet capture of the dumpfile calculated as the duration between the capture of the first and last packets.
The subsequent lines indicate the two TCP connections traced from the dumpfile. The first connection was seen between machines pride.cs.ohiou.edu at TCP port 54735, and elephus.cs.ohiou.edu at TCP port ssh (22). Similarly the second connection was seen between machines pride.cs.ohiou.edu at TCP port 54736, and a17-112-152-32.apple.com at TCP port http (80). tcptrace uses a labeling scheme to refer to individual connections traced. In the above example the two connections are labeled a2b and c2d respectively. For the first connection, 30 packets were seen in the a2b direction (pride.cs.ohiou.edu == elephus.cs.ohiou.edu) and 30 packets were seen in the b2a direction (elephus.cs.ohiou.edu == pride.cs.ohiou.edu). The two connections are reported as complete indicating that the entire TCP connection was traced i.e., SYN and FIN segments opening and closing the connection were traced. TCP connections may also be reported as reset if the connection was closed with an RST segment, or unidirectional if traffic was seen flowing in only one direction.
The above brief output generated by tcptrace can also be generated with the -b option. In the above example, tcptrace looked up names (elephus.cs.ohiou.edu, for example) and service names (http, for example) involving a DNS name lookup operation. Such name and service lookups can be turned off with the -n option to make tcptrace process faster. If you need name lookups but would rather have the short names of machines (elephus instead of elephus.cs.ohiou.edu for example), use the -s option.