Beluga:/Users/mani/dmpfiles> tcptrace -n rexmit.dmp.gz 1 arg remaining, starting with 'rexmit.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 6401 packets seen, 6401 TCP packets traced elapsed wallclock time: 0:00:00.102161, 62656 pkts/sec analyzed trace file elapsed time: 0:20:57.758299 TCP connection info: 1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b) 178> 113< (complete) 2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311< (complete) 3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f) 60> 18< 4: 132.235.67.82:2666 - 132.235.67.36:9119 (g2h) 910> 872< (complete) (reset) 5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j) 722> 676< (complete) (reset) 6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l) 56> 16< 7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n) 48> 14< 8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p) 40> 9<
Using the -o option with 3,5,7 as shown below, filters out only the 3rd, 5th, and 7th connections out.
Beluga:/Users/mani/dmpfiles> tcptrace -n -o3,5,7 rexmit.dmp.gz 1 arg remaining, starting with 'rexmit.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 6401 packets seen, 6401 TCP packets traced elapsed wallclock time: 0:00:00.086056, 74381 pkts/sec analyzed trace file elapsed time: 0:20:57.758299 TCP connection info: 3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f) 60> 18< 5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j) 722> 676< (complete) (reset) 7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n) 48> 14<
You may use the -l option (Section 4.1) for example, to generate the detailed statistics of only these connections as in
tcptrace -n -o3,5,7 -l rexmit.dmp.gz
Similarly graphs can be generated for the connections you are interested in alone for example, by combining both the -o and -G options. The following example illustrates how you could specify a range of connections with the -o option to get only the connections 1-3, 5, 7-8 from the dumpfile.
Beluga:/Users/mani/dmpfiles> tcptrace -n -o1-3,5,7-8 rexmit.dmp.gz 1 arg remaining, starting with 'rexmit.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 6401 packets seen, 6401 TCP packets traced elapsed wallclock time: 0:00:00.092103, 69498 pkts/sec analyzed trace file elapsed time: 0:20:57.758299 TCP connection info: 1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b) 178> 113< (complete) 2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311< (complete) 3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f) 60> 18< 5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j) 722> 676< (complete) (reset) 7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n) 48> 14< 8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p) 40> 9<
You may also store the connection numbers in a data file conn.dat for example and pass it to the -o option. The -o option opens and reads from a file if the character following the -o is not a numeral. For example, when the conn.dat file had just the line
1-3, 6-8it causes connections 1-3 and 6-8 alone to be filtered out.
Beluga:/Users/mani/dmpfiles> tcptrace -n -oconn.dat rexmit.dmp.gz 1 arg remaining, starting with 'rexmit.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 6401 packets seen, 6401 TCP packets traced elapsed wallclock time: 0:00:00.091752, 69764 pkts/sec analyzed trace file elapsed time: 0:20:57.758299 TCP connection info: 1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b) 178> 113< (complete) 2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311< (complete) 3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f) 60> 18< 6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l) 56> 16< 7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n) 48> 14< 8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p) 40> 9<
Sometimes it could be useful to save only the filtered connections into a new dumpfile. This can be done with the -O option.
The following example saves just the connections 4-6 into the file filt_rexmit.dmp.
Beluga:/Users/mani/dmpfiles> tcptrace -n -o4-6 -Ofilt_rexmit.dmp rexmit.dmp.gz 1 arg remaining, starting with 'rexmit.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 6401 packets seen, 6401 TCP packets traced elapsed wallclock time: 0:00:00.102007, 62750 pkts/sec analyzed trace file elapsed time: 0:20:57.758299 TCP connection info: 4: 132.235.67.82:2666 - 132.235.67.36:9119 (g2h) 910> 872< (complete) (reset) 5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j) 722> 676< (complete) (reset) 6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l) 56> 16<
Ignoring certain connections alone can be done too, with the -i option. The usage of the -i option is very similar to the -o option.
For example,
tcptrace -n -i1 rexmit.dmp.gz
ignores the first connection alone, and
tcptrace -n -i1,3-5 rexmit.dmp.gz
ignores connections 1, 3, 4, and 5. A data file containing a list of connection numbers to ignore can also be given in the -i option (as shown above for the -o option).
The -c option is useful if you are interested in looking at only complete connections i.e., the connections for which both the SYN and FIN segments opening and closing the connection were seen.
Finally, for some reason if you are interested in looking only at the first 200 packets found in the file for example, you may use the -E option as in
tcptrace -n -E200 rexmit.dmp.gzYou may also begin at the 300th packet in the file for example, with the -B option as in
tcptrace -n -B300 rexmit.dmp.gzUsing both the options, lets you look at a range of packets as they occurred in the dumpfile, as in
tcptrace -n -B100 -E200 rexmit.dmp.gz