Time-Line Graph

The goal of the Time-Line graphs is to generate graphs similar to the pretty graphs found in the book ``TCP/IP Illustrated Volume I'' by W. Richard Stevens [7], illustrating the activities of connections. The graphs can be generated with the -L option and generates graphs named as X_Y_tline.xpl

The Time-Line graphs are still EXPERIMENTAL and are under development. The fundamental problem with generating these graphs is that the time values for the segments arriving/leaving are available only from the end where the traffic was captured, while the time values of when the packets arrived or left at the other end have to be estimated with some heuristic. Doing this right tends to be a hard problem taking care of conditions like retransmits, timeouts etc. The current heuristic is a simple one of adding/subtracting 1/3rd of the rtt.

This graph provides a pictorial view of the segments being transmitted in either direction, over the duration of the connection. The Y-axis shows increasing time going from the top to bottom of the graph. The X-axis shows the segments being transmitted between the 2 hosts communicating. As you zoom in with xplot, more and more details will become visible. Here is an example of a time line graph:

Figure 5.13: Time-Line Graph #1
Image tline1

Following is a closeup (zoomed in with xplot):

Figure 5.14: Time-Line Graph #2
Image tline2

The following features can be seen in the graph

Axis
X-axis : segments being transmitted in either direction (zoom in to see the arrow heads for the correct direction)

Y-axis : running time of the connection (TOP to BOTTOM, ignoring the negative sign)

Graph Features
Green Lines
The green lines show the segments traveling in the direction a->b

Yellow Lines
The yellow lines show the segments traveling in the direction b->a

Labels
The labels alongside the segments have the following format:

TCP Flags (only if set), sequence_number_from:sequence_number_to(difference, bytes transmitted), acknowledgment_sequence_number, advertised window, retransmit indicator (``R''), hardware duplicate indicator (``HD'')

The sequence number for the first segment in either direction is absolute, while the rest are relative to the first segment.


Super-User 2003-08-29