The COLLIE module is a simple module that can display basic information on the connections (TCP and UDP) found in the dumpfile. A sample output is shown below.
Beluga:/Users/mani> tcptrace -xcollie alastor.dmp.gz 1 arg remaining, starting with 'alastor.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 86 packets seen, 83 TCP packets traced, 2 UDP packets traced elapsed wallclock time: 0:00:00.052520, 1637 pkts/sec analyzed trace file elapsed time: 0:00:11.623647 Source file: alastor.dmp.gz File modification timestamp: Wed Aug 6 18:27:22 2003 First packet: Tue Aug 5 15:34:30.680899 2003 Last packet: Tue Aug 5 15:34:42.304547 2003 TCP Connections Session Start: Tue Aug 5 15:34:40.318839 2003 Session End: Tue Aug 5 15:34:40.373548 2003 Source IP address: 132.235.3.140 Source Port: 51214 Source Fully Qualified domain name: pride.cs.ohiou.edu Destination IP address: 132.235.3.154 Destination Port: 80 Destination Fully Qualified domain name: masaka.cs.ohiou.edu Bytes Transferred Source to Destination: 1796 Bytes Transferred Destination to Source: 17895 Packets Transferred Source to Destination: 8 Packets Transferred Destination to Source: 17 Session Start: Tue Aug 5 15:34:30.680899 2003 . . . . . . UDP Connections Session Start: Tue Aug 5 15:34:40.313479 2003 Session End: Tue Aug 5 15:34:40.317724 2003 Source IP address: 132.235.3.140 Source Port: 49572 Source Fully Qualified domain name: pride.cs.ohiou.edu Destination IP address: 132.235.64.1 Destination Port: 53 Destination Fully Qualified domain name: watson.cns.ohiou.edu Bytes Transferred Source to Destination: 42 Bytes Transferred Destination to Source: 143 Packets Transferred Source to Destination: 1 Packets Transferred Destination to Source: 1
The collie module has the side effect of turning on UDP processing (the -u) option. As shown above, the module prints details on the source file (alastor.dmp.gz), when it was last modified, and the times of the first and last packets found in the file. Subsequent lines print basic information on the TCP and UDP connections traced. The information includes the times when the first and last packet of the connection were found (Session Start, Session Start respectively); the source and destination endpoints, the total number of bytes and packets transferred in the either direction of the connection. Note that the collie module prints the connection information in reverse chronological order, i.e., the most recently opened connection's information gets printed before a connection opened earlier.
The following options are supported by the collie module and are to be supplied as ARGS in -xcollie''ARGS'' to tcptrace in command line.