COLLIE Module

The COLLIE module is a simple module that can display basic information on the connections (TCP and UDP) found in the dumpfile. A sample output is shown below.

Beluga:/Users/mani> tcptrace -xcollie alastor.dmp.gz
1 arg remaining, starting with 'alastor.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

86 packets seen, 83 TCP packets traced, 2 UDP packets traced
elapsed wallclock time: 0:00:00.052520, 1637 pkts/sec analyzed
trace file elapsed time: 0:00:11.623647

Source file: alastor.dmp.gz
File modification timestamp: Wed Aug  6 18:27:22 2003
First packet: Tue Aug  5 15:34:30.680899 2003
Last packet: Tue Aug  5 15:34:42.304547 2003

TCP Connections

Session Start: Tue Aug  5 15:34:40.318839 2003 
Session End: Tue Aug  5 15:34:40.373548 2003
Source IP address: 132.235.3.140
Source Port: 51214
Source Fully Qualified domain name: pride.cs.ohiou.edu
Destination IP address: 132.235.3.154
Destination Port: 80
Destination Fully Qualified domain name: masaka.cs.ohiou.edu
Bytes Transferred Source to Destination: 1796
Bytes Transferred Destination to Source: 17895
Packets Transferred Source to Destination: 8
Packets Transferred Destination to Source: 17

Session Start: Tue Aug  5 15:34:30.680899 2003 
. . .
. . .

UDP Connections

Session Start: Tue Aug  5 15:34:40.313479 2003 
Session End: Tue Aug  5 15:34:40.317724 2003
Source IP address: 132.235.3.140
Source Port: 49572
Source Fully Qualified domain name: pride.cs.ohiou.edu
Destination IP address: 132.235.64.1
Destination Port: 53
Destination Fully Qualified domain name: watson.cns.ohiou.edu
Bytes Transferred Source to Destination: 42
Bytes Transferred Destination to Source: 143
Packets Transferred Source to Destination: 1
Packets Transferred Destination to Source: 1

The collie module has the side effect of turning on UDP processing (the -u) option. As shown above, the module prints details on the source file (alastor.dmp.gz), when it was last modified, and the times of the first and last packets found in the file. Subsequent lines print basic information on the TCP and UDP connections traced. The information includes the times when the first and last packet of the connection were found (Session Start, Session Start respectively); the source and destination endpoints, the total number of bytes and packets transferred in the either direction of the connection. Note that the collie module prints the connection information in reverse chronological order, i.e., the most recently opened connection's information gets printed before a connection opened earlier.

The following options are supported by the collie module and are to be supplied as ARGS in -xcollie''ARGS'' to tcptrace in command line.


Super-User 2003-08-29