tcptrace can produce detailed statistics of TCP connections from dumpfiles when given the -l or the long output option. The -l option produces output similar to the one shown in this example.
Beluga:/Users/mani> tcptrace -l malus.dmp.gz 1 arg remaining, starting with 'malus.dmp.gz' Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003 32 packets seen, 32 TCP packets traced elapsed wallclock time: 0:00:00.037948, 843 pkts/sec analyzed trace file elapsed time: 0:00:00.404427 TCP connection info: 1 TCP connection traced: TCP connection 1: host a: elephus.cs.ohiou.edu:59518 host b: a17-112-152-32.apple.com:http complete conn: yes first packet: Thu Jul 10 19:12:54.914101 2003 last packet: Thu Jul 10 19:12:55.318528 2003 elapsed time: 0:00:00.404427 total packets: 32 filename: malus.dmp.gz a->b: b->a: total packets: 16 total packets: 16 ack pkts sent: 15 ack pkts sent: 16 pure acks sent: 13 pure acks sent: 2 sack pkts sent: 0 sack pkts sent: 0 dsack pkts sent: 0 dsack pkts sent: 0 max sack blks/ack: 0 max sack blks/ack: 0 unique bytes sent: 450 unique bytes sent: 18182 actual data pkts: 1 actual data pkts: 13 actual data bytes: 450 actual data bytes: 18182 rexmt data pkts: 0 rexmt data pkts: 0 rexmt data bytes: 0 rexmt data bytes: 0 zwnd probe pkts: 0 zwnd probe pkts: 0 zwnd probe bytes: 0 zwnd probe bytes: 0 outoforder pkts: 0 outoforder pkts: 0 pushed data pkts: 1 pushed data pkts: 1 SYN/FIN pkts sent: 1/1 SYN/FIN pkts sent: 1/1 req 1323 ws/ts: Y/Y req 1323 ws/ts: Y/Y adv wind scale: 0 adv wind scale: 0 req sack: Y req sack: N sacks sent: 0 sacks sent: 0 urgent data pkts: 0 pkts urgent data pkts: 0 pkts urgent data bytes: 0 bytes urgent data bytes: 0 bytes mss requested: 1460 bytes mss requested: 1460 bytes max segm size: 450 bytes max segm size: 1448 bytes min segm size: 450 bytes min segm size: 806 bytes avg segm size: 449 bytes avg segm size: 1398 bytes max win adv: 40544 bytes max win adv: 33304 bytes min win adv: 5840 bytes min win adv: 33304 bytes zero win adv: 0 times zero win adv: 0 times avg win adv: 23174 bytes avg win adv: 33304 bytes initial window: 450 bytes initial window: 1448 bytes initial window: 1 pkts initial window: 1 pkts ttl stream length: 450 bytes ttl stream length: 18182 bytes missed data: 0 bytes missed data: 0 bytes truncated data: 420 bytes truncated data: 17792 bytes truncated packets: 1 pkts truncated packets: 13 pkts data xmit time: 0.000 secs data xmit time: 0.149 secs idletime max: 103.7 ms idletime max: 99.9 ms throughput: 1113 Bps throughput: 44957 Bps
The initial lines of output are similar to the brief output explained in Chapter 3. The following lines indicate that the hosts involved in the connection and their TCP port numbers are:
host a: elephus.cs.ohiou.edu:59518 host b: a17-112-152-32.apple.com:httpThe following lines indicate that the connection was seen to be complete i.e., the connection was traced in its entirety with the SYN and FIN segments of the connection observed in the dumpfile. The time at which the first and last packets of the connection were captured is reported, followed by the lifetime of the connection, and the number of packets seen. Then, the filename currently being processed is listed, followed by the multiple TCP statistics for the forward (a2b) and the reverse (b2a) directions.
We explain the TCP parameter statistics in the following, for the a2b direction. Similar explanation would hold for the b2a direction too.
Note that since Window Scaling option is sent only in SYN packets, this field is meaningful only if the connection was captured fully in the dumpfile to include the SYN packets.