Detailed Stats

tcptrace can produce detailed statistics of TCP connections from dumpfiles when given the -l or the long output option. The -l option produces output similar to the one shown in this example.

Beluga:/Users/mani> tcptrace -l malus.dmp.gz

1 arg remaining, starting with 'malus.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

32 packets seen, 32 TCP packets traced
elapsed wallclock time: 0:00:00.037948, 843 pkts/sec analyzed
trace file elapsed time: 0:00:00.404427
TCP connection info:
1 TCP connection traced:
TCP connection 1:
	host a:        elephus.cs.ohiou.edu:59518
	host b:        a17-112-152-32.apple.com:http
	complete conn: yes
	first packet:  Thu Jul 10 19:12:54.914101 2003
	last packet:   Thu Jul 10 19:12:55.318528 2003
	elapsed time:  0:00:00.404427
	total packets: 32
	filename:      malus.dmp.gz
   a->b:			      b->a:
     total packets:            16           total packets:            16      
     ack pkts sent:            15           ack pkts sent:            16      
     pure acks sent:           13           pure acks sent:            2      
     sack pkts sent:            0           sack pkts sent:            0      
     dsack pkts sent:           0           dsack pkts sent:           0      
     max sack blks/ack:         0           max sack blks/ack:         0      
     unique bytes sent:       450           unique bytes sent:     18182      
     actual data pkts:          1           actual data pkts:         13      
     actual data bytes:       450           actual data bytes:     18182      
     rexmt data pkts:           0           rexmt data pkts:           0      
     rexmt data bytes:          0           rexmt data bytes:          0      
     zwnd probe pkts:           0           zwnd probe pkts:           0      
     zwnd probe bytes:          0           zwnd probe bytes:          0      
     outoforder pkts:           0           outoforder pkts:           0      
     pushed data pkts:          1           pushed data pkts:          1      
     SYN/FIN pkts sent:       1/1           SYN/FIN pkts sent:       1/1      
     req 1323 ws/ts:          Y/Y           req 1323 ws/ts:          Y/Y      
     adv wind scale:            0           adv wind scale:            0      
     req sack:                  Y           req sack:                  N      
     sacks sent:                0           sacks sent:                0      
     urgent data pkts:          0 pkts      urgent data pkts:          0 pkts 
     urgent data bytes:         0 bytes     urgent data bytes:         0 bytes
     mss requested:          1460 bytes     mss requested:          1460 bytes
     max segm size:           450 bytes     max segm size:          1448 bytes
     min segm size:           450 bytes     min segm size:           806 bytes
     avg segm size:           449 bytes     avg segm size:          1398 bytes
     max win adv:           40544 bytes     max win adv:           33304 bytes
     min win adv:            5840 bytes     min win adv:           33304 bytes
     zero win adv:              0 times     zero win adv:              0 times
     avg win adv:           23174 bytes     avg win adv:           33304 bytes
     initial window:          450 bytes     initial window:         1448 bytes
     initial window:            1 pkts      initial window:            1 pkts 
     ttl stream length:       450 bytes     ttl stream length:     18182 bytes
     missed data:               0 bytes     missed data:               0 bytes
     truncated data:          420 bytes     truncated data:        17792 bytes
     truncated packets:         1 pkts      truncated packets:        13 pkts 
     data xmit time:        0.000 secs      data xmit time:        0.149 secs 
     idletime max:          103.7 ms        idletime max:           99.9 ms   
     throughput:             1113 Bps       throughput:            44957 Bps

The initial lines of output are similar to the brief output explained in Chapter 3. The following lines indicate that the hosts involved in the connection and their TCP port numbers are:

	host a:        elephus.cs.ohiou.edu:59518
	host b:        a17-112-152-32.apple.com:http
The following lines indicate that the connection was seen to be complete i.e., the connection was traced in its entirety with the SYN and FIN segments of the connection observed in the dumpfile. The time at which the first and last packets of the connection were captured is reported, followed by the lifetime of the connection, and the number of packets seen. Then, the filename currently being processed is listed, followed by the multiple TCP statistics for the forward (a2b) and the reverse (b2a) directions.

We explain the TCP parameter statistics in the following, for the a2b direction. Similar explanation would hold for the b2a direction too.


Super-User 2003-08-29