TRAFFIC Module

We have seen in the earlier chapters that tcptrace can generate detailed statistics and graphs from a dumpfile on a per connection basis. The goal of the traffic module is to raise the level of abstraction and present statistics on a per port basis, and for the entire traffic found in the dumpfile.

The traffic module can be invoked as follows :

tcptrace -xtraffic``[ARGS]'' <dumpfile>
where the field ARGS represents any arguments to be sent to the traffic module, and are explained in the following.

When the traffic module is invoked without any arguments as in :

surya:/home/mani> tcptrace -xtraffic sack_city.dmp.gz
mod_traffic: characterizing traffic
1 arg remaining, starting with 'sack_city.dmp.gz'
Ostermann's tcptrace -- version 6.4.7 -- Fri Aug 1, 2003

28427 packets seen, 28427 TCP packets traced
elapsed wallclock time: 0:00:00.649954, 43736 pkts/sec analyzed
trace file elapsed time: 1:22:34.149090
Dumping port statistics into file traffic_byport.dat
Dumping overall statistics into file traffic_stats.dat
Plotting performed at 15.000 second intervals

it generates two data files traffic_stats.dat and traffic_byport.dat.

The traffic_stats.dat file has statistics on the entire traffic found from the dumpfile and looks as in :

Overall Statistics over 4954 seconds (1:22:34.149090):
12531375 ttl bytes sent, 2529.547 bytes/second
8590918 ttl non-rexmit bytes sent, 1734.138 bytes/second
3940457 ttl rexmit bytes sent, 795.409 bytes/second
28427 packets sent, 5.738 packets/second
19 connections opened, 0.004 conns/second
59 dupacks sent, 0.012 dupacks/second
3015 rexmits sent, 0.609 rexmits/second
average RTT: 78.268 msecs

From the above, we can notice that the traffic module prints the total time the dumpfile lasted; the total (ttl) number of bytes sent, average bytes sent per second; the total number of retransmitted and non-retransmitted bytes and the average bytes (retransmitted and non-retransmitted) per second; the total number of packets, connections, duplicate acks (dupacks) and retransmits (rexmits) seen (along with their respective averages seen per second) and finally the average RTT found from all the RTT samples. Note that the average RTT includes RTT samples found that were ambiguous too (Total samples = RTT samples + ambiguous acks as explained in Section 4.2.

The traffic_byport.dat file looks as in :

Overall totals by port
TOTAL        bytes:     12531375  pkts:      28427  conns:       19  tput:     2529 B/s
Port    22   bytes:       892552  pkts:      10324  conns:        1  tput:      180 B/s
Port  5002   bytes:     11638823  pkts:      18103  conns:       18  tput:     2349 B/s
. . .
listing per-port statistics on the bytes, packets, connections, and the observed throughput.

The -p option to the traffic module lets it gather statistics only on certain ports of interest.

For example :

tcptrace -xtraffic''-p80'' rubeus.dmp
prints statistics for just web connections (TCP port 80), while

tcptrace -xtraffic''-p1-1024'' rubeus.dmp

prints statistics only for TCP connections with either of the ports in the range of 1 to 1024 (inclusive).

You may also selectively ignore web traffic (port 80) but have the rest of the low port traffic as analyzed above with :

tcptrace -xtraffic''-p1-1024,-80'' rubeus.dmp

The following

tcptrace -xtraffic''-p1-1024,-80-89'' rubeus.dmp

ignores traffic destined to ports 80-89 while choosing the connections destined to the rest of the ports in the range 1-1024.

The traffic module can also generate graphs that can be read with the xplot program as explained below.


Super-User 2003-08-29