Real-Time Analysis
Real-Time analysis can be done trivially by piping the output of the packet
capture program, and letting
tcptrace
fetch its input from stdin.
With tcpdump, it can be done as in :
tcpdump -w - | tcptrace stdin
This would let
tcptrace
read the input from the binary output generated by
tcpdump, until the process is interrupted with say Ctrl C,
for example. However, this is not really real-time in the sense that the
output is generated only after the process is interrupted, which is
analogous to
tcptrace
printing output at the end of processing a dumpfile.
The option --continuous lets
tcptrace
run continuously
and provides no summary of connections at the end. This option is normally
useful when used along with modules and maintains a list of active connections.
The following options can be used along with the
--continuous option :
- --limit_conn_num Limits the number of active
connections kept track of, to the default value of 50000 connections to save
on memory.
- --max_conn_num=... Lets you choose the maximum
number of connections to be kept track of. If the maximum connection limit
is reached, the least recently used connection is removed to make space for
the new connection.
- --update_interval=... When operating in the
--continuous mode,
tcptrace
periodically looks at the
list of live and inactive connections and updates the list removing ``old''
connections. The default update interval is 30 seconds, which can be changed
using this option giving the update interval in seconds.
- --remove_live_conn_interval=... The default
interval after which a live connection is removed from the list of live
connections is 8*3600 seconds (8 hours). This option can be used to
customize this interval, giving a suitable value in seconds.
Note that a TCP connection is considered live until
a FIN / RST segment is seen in the connection.
- --remove_closed_conn_interval=... Once a FIN /
RST segment is seen in a connection, it is moved from the list of live
connections to the list of inactive connections. The default interval (from
the time at which the last packet was seen in the connection) after which a
connection is removed from the list of inactive connections is 8*60 seconds
(8 minutes). This option can be used to
customize this interval, giving a suitable value in seconds.
Super-User
2003-08-29