The traffic module can be invoked as follows :
tcptrace -xtraffic``[ARGS]'' <dumpfile>where the field ARGS represents any arguments to be sent to the traffic module, and are explained in the following.
When the traffic module is invoked without any arguments as in :
surya:/home/mani> tcptrace -xtraffic sack_city.dmp.gz mod_traffic: characterizing traffic 1 arg remaining, starting with 'sack_city.dmp.gz' Ostermann's tcptrace -- version 6.4.7 -- Fri Aug 1, 2003 28427 packets seen, 28427 TCP packets traced elapsed wallclock time: 0:00:00.649954, 43736 pkts/sec analyzed trace file elapsed time: 1:22:34.149090 Dumping port statistics into file traffic_byport.dat Dumping overall statistics into file traffic_stats.dat Plotting performed at 15.000 second intervals
it generates two data files traffic_stats.dat and traffic_byport.dat.
The traffic_stats.dat file has statistics on the entire traffic found from the dumpfile and looks as in :
Overall Statistics over 4954 seconds (1:22:34.149090): 12531375 ttl bytes sent, 2529.547 bytes/second 8590918 ttl non-rexmit bytes sent, 1734.138 bytes/second 3940457 ttl rexmit bytes sent, 795.409 bytes/second 28427 packets sent, 5.738 packets/second 19 connections opened, 0.004 conns/second 59 dupacks sent, 0.012 dupacks/second 3015 rexmits sent, 0.609 rexmits/second average RTT: 78.268 msecs
From the above, we can notice that the traffic module prints the total time the dumpfile lasted; the total (ttl) number of bytes sent, average bytes sent per second; the total number of retransmitted and non-retransmitted bytes and the average bytes (retransmitted and non-retransmitted) per second; the total number of packets, connections, duplicate acks (dupacks) and retransmits (rexmits) seen (along with their respective averages seen per second) and finally the average RTT found from all the RTT samples. Note that the average RTT includes RTT samples found that were ambiguous too (Total samples = RTT samples + ambiguous acks as explained in Section 4.2.
The traffic_byport.dat file looks as in :
Overall totals by port TOTAL bytes: 12531375 pkts: 28427 conns: 19 tput: 2529 B/s Port 22 bytes: 892552 pkts: 10324 conns: 1 tput: 180 B/s Port 5002 bytes: 11638823 pkts: 18103 conns: 18 tput: 2349 B/s . . .listing per-port statistics on the bytes, packets, connections, and the observed throughput.
The -p option to the traffic module lets it gather statistics only on certain ports of interest.
For example :
tcptrace -xtraffic''-p80'' rubeus.dmpprints statistics for just web connections (TCP port 80), while
tcptrace -xtraffic''-p1-1024'' rubeus.dmp
prints statistics only for TCP connections with either of the ports in the range of 1 to 1024 (inclusive).
You may also selectively ignore web traffic (port 80) but have the rest of the low port traffic as analyzed above with :
tcptrace -xtraffic''-p1-1024,-80'' rubeus.dmp
The following
tcptrace -xtraffic''-p1-1024,-80-89'' rubeus.dmp
ignores traffic destined to ports 80-89 while choosing the connections destined to the rest of the ports in the range 1-1024.
The traffic module can also generate graphs that can be read with the xplot program as explained below.
surya:/home/mani> tcptrace -xtraffic''-p22,80 -B'' minerva.dmpgenerated the graph shown in Figure 9.1 and illustrates the bytes-per-second seen on ports 22 and 80 respectively. The traffic module plots the graphs at discrete intervals of 15 seconds on the x-axis by default. This interval at which the graph is plotted can be altered if necessary with the -iS option, where S represents the interval S in seconds. Note that if there a lot of ports being analyzed, your graph may have as many colors. Please zoom into the beginning of the graphs to find out which colored line in the graph represents the port number you are interested in.
The blue-line tracks actual retransmit events per second observed in the past interval while the yellow-line tracks the number of triple duplicate acks observed per second in the past interval.
The green-line tracks the minimum RTT observed, the blue-line the average RTT observed, and the red-line tracks the maximum observed RTT. Note that, you may choose to generate the graph of RTT values in the range of interest, between 100 milli-sec and 200 milli-sec for example giving -R100-200. This would consider only the RTT samples in the range 100-200 msecs observed in the past interval for plotting.
Note that, the -G option can be used to generate all the graphs. Further, in all the graphs that carry information on a per port basis, a green line always tracks the total value of the statistic represented on the y-axis, summing up the statistic of all the individual ports drawn in the graph.