UDP Analysis

tcptrace analyzes UDP [1] traffic minimally with the -u option. The following example illustrates the same :

Beluga:/Users/mani/tcptrace-manual> tcptrace -n -u dmpfiles/udp.dmp.gz
1 arg remaining, starting with 'dmpfiles/udp.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

14 packets seen, 0 TCP packets traced, 14 UDP packets traced
elapsed wallclock time: 0:00:00.023567, 594 pkts/sec analyzed
trace file elapsed time: 0:00:00.390867
no traced TCP packets
UDP connection info:
  1: 132.235.3.154:46096 - 132.235.1.1:53 (a2b)    1>    1<
  2: 132.235.3.154:46097 - 132.235.1.1:53 (c2d)    1>    1<
  3: 132.235.3.154:46098 - 132.235.1.1:53 (e2f)    1>    1<
  4: 132.235.3.154:46099 - 132.235.1.1:53 (g2h)    1>    1<
  5: 132.235.19.80:2649 - 132.235.18.1:53 (i2j)    2>    2<
  6: 132.235.19.80:2650 - 132.235.64.1:53 (k2l)    1>    1<

Since there is no implicit notion of connections with UDP, tcptrace groups connections from the same pair of IP addresses and same pair of UDP ports to belong to a ``connection''.

Giving the -l option along with the -u option generates more detailed statistics as shown below :

Beluga:/Users/mani/tcptrace-manual> tcptrace -nul dmpfiles/udp.dmp.gz
1 arg remaining, starting with 'dmpfiles/udp.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

14 packets seen, 0 TCP packets traced, 14 UDP packets traced
elapsed wallclock time: 0:00:00.026584, 526 pkts/sec analyzed
trace file elapsed time: 0:00:00.390867
no traced TCP packets
UDP connection info:
6 UDP connections traced:
UDP connection 1:
	host a:        132.235.3.154:46096
	host b:        132.235.1.1:53

	first packet:  Wed Oct 31 14:11:11.046435 2001
	last packet:   Wed Oct 31 14:11:11.048531 2001
	elapsed time:  0:00:00.002096
	total packets: 2
	filename:      dmpfiles/udp.dmp.gz
   a->b:			      b->a:
     total packets:             1           total packets:             1      
     data bytes sent:          46           data bytes sent:         367      
     throughput:            21947 Bps       throughput:           175095 Bps  
================================
UDP connection 2:
                  . . .

The total packets field lists the total number of packets seen in the direction, while the data bytes sent field lists the total number of bytes seen in the direction. The throughput field lists average throughput calculated as the total bytes seen divided by the connection lifetime (the time elapsed between the first and last packets of the connection).

Analogous to the connection filtering options -o and -i used for selectively processing or ignoring TCP connections (refer Section 6.1), options --oUDP and --iUDP options selectively process or ignore UDP connections, with the same semantics.

The following example illustrates selecting just UDP connections 1,3,5 and storing them to file filt_udp.dmp :

Beluga:/Users/mani/tcptrace-manual> tcptrace -n -u --oUDP1,3,5 -Ofilt_udp.dmp dmpfiles/udp.dmp.gz
1 arg remaining, starting with 'dmpfiles/udp.dmp.gz'
Ostermann's tcptrace -- version 6.4.6 -- Tue Jul 1, 2003

14 packets seen, 0 TCP packets traced, 14 UDP packets traced
elapsed wallclock time: 0:00:00.022974, 609 pkts/sec analyzed
trace file elapsed time: 0:00:00.390867
no traced TCP packets
UDP connection info:
  1: 132.235.3.154:46096 - 132.235.1.1:53 (a2b)    1>    1<
  3: 132.235.3.154:46098 - 132.235.1.1:53 (e2f)    1>    1<
  5: 132.235.19.80:2649 - 132.235.18.1:53 (i2j)    2>    2<


Super-User 2003-08-29