Beluga:/Users/mani/tcptrace-manual> tcptrace -n -u dmpfiles/udp.dmp.gz 1 arg remaining, starting with 'dmpfiles/udp.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 14 packets seen, 0 TCP packets traced, 14 UDP packets traced elapsed wallclock time: 0:00:00.023567, 594 pkts/sec analyzed trace file elapsed time: 0:00:00.390867 no traced TCP packets UDP connection info: 1: 132.235.3.154:46096 - 132.235.1.1:53 (a2b) 1> 1< 2: 132.235.3.154:46097 - 132.235.1.1:53 (c2d) 1> 1< 3: 132.235.3.154:46098 - 132.235.1.1:53 (e2f) 1> 1< 4: 132.235.3.154:46099 - 132.235.1.1:53 (g2h) 1> 1< 5: 132.235.19.80:2649 - 132.235.18.1:53 (i2j) 2> 2< 6: 132.235.19.80:2650 - 132.235.64.1:53 (k2l) 1> 1<
Since there is no implicit notion of connections with UDP, tcptrace groups connections from the same pair of IP addresses and same pair of UDP ports to belong to a ``connection''.
Giving the -l option along with the -u option generates more detailed statistics as shown below :
Beluga:/Users/mani/tcptrace-manual> tcptrace -nul dmpfiles/udp.dmp.gz 1 arg remaining, starting with 'dmpfiles/udp.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 14 packets seen, 0 TCP packets traced, 14 UDP packets traced elapsed wallclock time: 0:00:00.026584, 526 pkts/sec analyzed trace file elapsed time: 0:00:00.390867 no traced TCP packets UDP connection info: 6 UDP connections traced: UDP connection 1: host a: 132.235.3.154:46096 host b: 132.235.1.1:53 first packet: Wed Oct 31 14:11:11.046435 2001 last packet: Wed Oct 31 14:11:11.048531 2001 elapsed time: 0:00:00.002096 total packets: 2 filename: dmpfiles/udp.dmp.gz a->b: b->a: total packets: 1 total packets: 1 data bytes sent: 46 data bytes sent: 367 throughput: 21947 Bps throughput: 175095 Bps ================================ UDP connection 2: . . .
The total packets field lists the total number of packets seen in the direction, while the data bytes sent field lists the total number of bytes seen in the direction. The throughput field lists average throughput calculated as the total bytes seen divided by the connection lifetime (the time elapsed between the first and last packets of the connection).
Analogous to the connection filtering options -o and -i used for selectively processing or ignoring TCP connections (refer Section 6.1), options --oUDP and --iUDP options selectively process or ignore UDP connections, with the same semantics.
The following example illustrates selecting just UDP connections 1,3,5 and storing them to file filt_udp.dmp :
Beluga:/Users/mani/tcptrace-manual> tcptrace -n -u --oUDP1,3,5 -Ofilt_udp.dmp dmpfiles/udp.dmp.gz 1 arg remaining, starting with 'dmpfiles/udp.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 14 packets seen, 0 TCP packets traced, 14 UDP packets traced elapsed wallclock time: 0:00:00.022974, 609 pkts/sec analyzed trace file elapsed time: 0:00:00.390867 no traced TCP packets UDP connection info: 1: 132.235.3.154:46096 - 132.235.1.1:53 (a2b) 1> 1< 3: 132.235.3.154:46098 - 132.235.1.1:53 (e2f) 1> 1< 5: 132.235.19.80:2649 - 132.235.18.1:53 (i2j) 2> 2<