Basic Filtering

The -o option can be used to only look at certain connections. For example 8 TCP connections were traced in the file rexmit.dmp.gz :

Beluga:/Users/mani/dmpfiles> tcptrace -n rexmit.dmp.gz
1 arg remaining, starting with 'rexmit.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

6401 packets seen, 6401 TCP packets traced
elapsed wallclock time: 0:00:00.102161, 62656 pkts/sec analyzed
trace file elapsed time: 0:20:57.758299
TCP connection info:
  1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b)  178>  113<  (complete)
  2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311<  (complete)
  3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f)   60>   18<
  4: 132.235.67.82:2666 - 132.235.67.36:9119 (g2h)  910>  872<  (complete)  (reset)
  5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j)  722>  676<  (complete)  (reset)
  6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l)   56>   16<
  7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n)   48>   14<
  8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p)   40>    9<

Using the -o option with 3,5,7 as shown below, filters out only the 3rd, 5th, and 7th connections out.

Beluga:/Users/mani/dmpfiles> tcptrace -n -o3,5,7 rexmit.dmp.gz
1 arg remaining, starting with 'rexmit.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

6401 packets seen, 6401 TCP packets traced
elapsed wallclock time: 0:00:00.086056, 74381 pkts/sec analyzed
trace file elapsed time: 0:20:57.758299
TCP connection info:
  3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f)   60>   18<
  5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j)  722>  676<  (complete)  (reset)
  7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n)   48>   14<

You may use the -l option (Section 4.1) for example, to generate the detailed statistics of only these connections as in

tcptrace -n -o3,5,7 -l rexmit.dmp.gz

Similarly graphs can be generated for the connections you are interested in alone for example, by combining both the -o and -G options. The following example illustrates how you could specify a range of connections with the -o option to get only the connections 1-3, 5, 7-8 from the dumpfile.

Beluga:/Users/mani/dmpfiles> tcptrace -n -o1-3,5,7-8 rexmit.dmp.gz
1 arg remaining, starting with 'rexmit.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

6401 packets seen, 6401 TCP packets traced
elapsed wallclock time: 0:00:00.092103, 69498 pkts/sec analyzed
trace file elapsed time: 0:20:57.758299
TCP connection info:
  1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b)  178>  113<  (complete)
  2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311<  (complete)
  3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f)   60>   18<
  5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j)  722>  676<  (complete)  (reset)
  7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n)   48>   14<
  8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p)   40>    9<

You may also store the connection numbers in a data file conn.dat for example and pass it to the -o option. The -o option opens and reads from a file if the character following the -o is not a numeral. For example, when the conn.dat file had just the line

1-3, 6-8
it causes connections 1-3 and 6-8 alone to be filtered out.

Beluga:/Users/mani/dmpfiles> tcptrace -n -oconn.dat rexmit.dmp.gz
1 arg remaining, starting with 'rexmit.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

6401 packets seen, 6401 TCP packets traced
elapsed wallclock time: 0:00:00.091752, 69764 pkts/sec analyzed
trace file elapsed time: 0:20:57.758299
TCP connection info:
  1: 132.235.67.82:1321 - 132.235.67.36:9080 (a2b)  178>  113<  (complete)
  2: 132.235.67.82:3396 - 132.235.67.36:9119 (c2d) 1358> 1311<  (complete)
  3: 132.235.67.82:2525 - 132.235.67.36:9080 (e2f)   60>   18<
  6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l)   56>   16<
  7: 132.235.67.82:3640 - 132.235.67.36:9080 (m2n)   48>   14<
  8: 132.235.67.82:4095 - 132.235.67.36:9080 (o2p)   40>    9<

Sometimes it could be useful to save only the filtered connections into a new dumpfile. This can be done with the -O option.

The following example saves just the connections 4-6 into the file filt_rexmit.dmp.

Beluga:/Users/mani/dmpfiles> tcptrace -n -o4-6 -Ofilt_rexmit.dmp rexmit.dmp.gz
1 arg remaining, starting with 'rexmit.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

6401 packets seen, 6401 TCP packets traced
elapsed wallclock time: 0:00:00.102007, 62750 pkts/sec analyzed
trace file elapsed time: 0:20:57.758299
TCP connection info:
  4: 132.235.67.82:2666 - 132.235.67.36:9119 (g2h)  910>  872<  (complete)  (reset)
  5: 132.235.67.82:3299 - 132.235.67.36:9119 (i2j)  722>  676<  (complete)  (reset)
  6: 132.235.67.82:3584 - 132.235.67.36:9080 (k2l)   56>   16<

Ignoring certain connections alone can be done too, with the -i option. The usage of the -i option is very similar to the -o option.

For example,

tcptrace -n -i1 rexmit.dmp.gz

ignores the first connection alone, and

tcptrace -n -i1,3-5 rexmit.dmp.gz

ignores connections 1, 3, 4, and 5. A data file containing a list of connection numbers to ignore can also be given in the -i option (as shown above for the -o option).

The -c option is useful if you are interested in looking at only complete connections i.e., the connections for which both the SYN and FIN segments opening and closing the connection were seen.

Finally, for some reason if you are interested in looking only at the first 200 packets found in the file for example, you may use the -E option as in

tcptrace -n -E200 rexmit.dmp.gz
You may also begin at the 300th packet in the file for example, with the -B option as in
tcptrace -n -B300 rexmit.dmp.gz
Using both the options, lets you look at a range of packets as they occurred in the dumpfile, as in
tcptrace -n -B100 -E200 rexmit.dmp.gz


Super-User 2003-08-29