tcptrace(1)

📦 version 6.6.7, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing

💖 tcptrace(1) 💖 — General Commands Manual, bestie edition

okay so bestie, this is the tcptrace(1) page, straight outta the General Commands Manual. It's giving TCP connection analysis, no cap. Let's get into it. 🫶

🌸 NAME 🌸

tcptrace — a TCP connection analysis tool

✨ SYNOPSIS ✨

tcptrace [options] filename

🦋 DESCRIPTION 🦋

tcptrace takes a tcpdump file specified on the command line (or from standard input) and produces a summarization of the connections. Literally that's the whole vibe. 💅

💅 OPTIONS 💅

🌈 Output format options 🌈

  • -b — brief output format
  • -l — long output format
  • -r — print rtt statistics (slower for large files)
  • -W — report on estimated congestion window (not generally useful)
  • -q — no output (if you just want modules output)

📈 Graphing options 📈

  • -T — create throughput graph[s], (average over 10 segments, see -A)
  • -R — create rtt sample graph[s]
  • -S — create time sequence graph[s]
  • -N — create owin graph[s] (_o_utstanding data on _N_etwork)
  • -F — create segsize graph[s]
  • -G — create ALL graphs

🔍 Output format detail options 🔍

  • -D — print in decimal
  • -X — print in hexadecimal
  • -n — don't resolve host or service names (much faster)
  • -s — use short names (list "picard.cs.ohiou.edu" as just "picard")

🎯 Connection filtering options 🎯

  • -iN — ignore connection N (can use multiple times)
  • -oN[-M] — only connection N (or N through M). Arg can be used many times. If N is a file rather than a number, read list from file instead.
  • -c — ignore non-complete connections (didn't see syn's and fin's)
  • -BN — first segment number to analyze (default 1)
  • -EN — last segment number to analyze (default last in file)

🎨 Graphing detail options 🎨

  • -C — produce color plot[s]
  • -M — produce monochrome (b/w) plot[s]
  • -AN — Average N segments for throughput graphs, default is 10
  • -z — zero axis options:
    • -z — plot time axis from 0 rather than wall clock time (backward compat)
    • -zx — plot time axis from 0 rather than wall clock time
    • -zy — plot sequence numbers from 0 (time sequence graphs only)
    • -zxy — plot both axes from 0
  • -y — omit the (yellow) instantaneous throughput points in tput graph

🛠️ Misc options 🛠️

  • -Z — dump raw rtt sample times to file[s]
  • -p — print all packet contents (can be very long)
  • -P — print packet contents for selected connections
  • -t — ´tick' off the packet numbers as a progress indication
  • -v — print version information and exit
  • -w — print various warning messages
  • -d — whistle while you work (enable debug, use -d -d for more output)
  • -e — extract contents of each TCP stream into file
  • -h — print help messages
  • -u — print minimal UDP information too
  • -Ofile — dump matched packets to tcpdump file 'file'
  • +[v] — reverse the setting of the -[v] flag (for booleans)

🧚 Extended boolean options (unambiguous prefixes also work) 🧚

  • --showsacks — show SACK blocks on time sequence graphs (default)
  • --noshowsacks — DON'T show SACK blocks on time sequence graphs
  • --showrexmit — mark retransmits on time sequence graphs (default)
  • --noshowrexmit — DON'T mark retransmits on time sequence graphs
  • --showoutorder — mark out-of-order on time sequence graphs (default)
  • --noshowoutorder — DON'T mark out-of-order on time sequence graphs
  • --showzerowindow — mark zero windows on time sequence graphs (default)
  • --noshowzerowindow — DON'T mark zero windows on time sequence graphs
  • --showurg — mark packets with URGENT bit set on the time sequence graphs (default)
  • --noshowurg — DON'T mark packets with URGENT bit set on the time sequence graphs
  • --showrttdongles — mark non-RTT-generating ACKs with special symbols
  • --noshowrttdongles — DON'T mark non-RTT-generating ACKs with special symbols (default)
  • --showdupack3 — mark triple dupacks on time sequence graphs (default)
  • --noshowdupack3 — DON'T mark triple dupacks on time sequence graphs
  • --showzerolensegs — show zero length packets on time sequence graphs (default)
  • --noshowzerolensegs — DON'T show zero length packets on time sequence graphs
  • --showzwndprobes — show zero window probe packets on time sequence graphs (default)
  • --noshowzwndprobes — DON'T show zero window probe packets on time sequence graphs
  • --showtitle — show title on the graphs (default)
  • --noshowtitle — DON'T show title on the graphs
  • --res_addr — resolve IP addresses into names (may be slow) (default)
  • --nores_addr — DON'T resolve IP addresses into names (may be slow)
  • --res_port — resolve port numbers into names (default)
  • --nores_port — DON'T resolve port numbers into names
  • --checksum — verify IP and TCP checksums
  • --nochecksum — DON'T verify IP and TCP checksums (default)
  • --dupack3_data — count a duplicate ACK carrying data as a triple dupack
  • --nodupack3_data — DON'T count a duplicate ACK carrying data as a triple dupack (default)
  • --check_hwdups — check for 'hardware' dups (default)
  • --nocheck_hwdups — DON'T check for 'hardware' dups
  • --warn_ooo — print warnings when packets timestamps are out of order
  • --nowarn_ooo — DON'T print warnings when packets timestamps are out of order (default)
  • --warn_printtrunc — print warnings when packets are too short to analyze
  • --nowarn_printtrunc — DON'T print warnings when packets are too short to analyze (default)
  • --warn_printbadmbz — print warnings when MustBeZero TCP fields are NOT 0
  • --nowarn_printbadmbz — DON'T print warnings when MustBeZero TCP fields are NOT 0 (default)
  • --warn_printhwdups — print warnings for hardware duplicates
  • --nowarn_printhwdups — DON'T print warnings for hardware duplicates (default)
  • --warn_printbadcsum — print warnings when packets with bad checksums
  • --nowarn_printbadcsum — DON'T print warnings when packets with bad checksums (default)
  • --warn_printbad_syn_fin_seq — print warnings when SYNs or FINs rexmitted with different sequence numbers
  • --nowarn_printbad_syn_fin_seq — DON'T print warnings when SYNs or FINs rexmitted with different sequence numbers (default)
  • --dump_packet_data — print all packets AND dump the TCP/UDP data
  • --nodump_packet_data — DON'T print all packets AND dump the TCP/UDP data (default)
  • --continuous — run continuously and don't provide a summary
  • --nocontinuous — DON'T run continuously and don't provide a summary (default)
  • --print_seq_zero — print sequence numbers as offset from initial sequence number
  • --noprint_seq_zero — DON'T print sequence numbers as offset from initial sequence number (default)
  • --limit_conn_num — limit the maximum number of connections kept at a time in real-time mode
  • --nolimit_conn_num — DON'T limit the maximum number of connections kept at a time in real-time mode (default)
  • --xplot_all_files — display all generated xplot files at the end
  • --noxplot_all_files — DON'T display all generated xplot files at the end (default)
  • --ns_hdrs — assume that ns has the useHeaders_flag true (uses IP+TCP headers) (default)
  • --nons_hdrs — DON'T assume that ns has the useHeaders_flag true (uses IP+TCP headers)
  • --csv — display the long output as comma separated values
  • --nocsv — DON'T display the long output as comma separated values (default)
  • --tsv — display the long output as tab separated values
  • --notsv — DON'T display the long output as tab separated values (default)

🧬 Extended variable options (unambiguous prefixes also work) 🧬

  • --output_dir=``STR'' — directory where all output files are placed (default: '<NULL>')
  • --output_prefix=``STR'' — prefix all output files with this string (default: '<NULL>')
  • --xplot_title_prefix=``STR'' — prefix to place in the titles of all xplot files (default: '<NULL>')
  • --update_interval=``STR'' — time interval for updates in real-time mode (default: '<NULL>')
  • --max_conn_num=``STR'' — maximum number of connections to keep at a time in real-time mode (default: '<NULL>')
  • --remove_live_conn_interval=``STR'' — idle time after which an open connection is removed in real-time mode (default: '<NULL>')
  • --remove_closed_conn_interval=``STR'' — time interval after which a closed connection is removed in real-time mode (default: '<NULL>')
  • --xplot_args=``STR'' — arguments to pass to xplot, if we are calling xplot from here (default: '<NULL>')
  • --sv=``STR'' — separator to use for long output with <STR>-separated-values (default: '<NULL>')

📦 Included Modules 📦

  • http — Http analysis package
  • tcplib — TCPLib analysis package
  • traffic — traffic analysis package
  • slice — traffic efficiency data by time slices
  • rttgraph — round trip time analysis graphs
  • collie — connection summary package
  • realtime — example real-time package

For module-specific options, please use tcptrace -hxargs ✨

🧿 Filter Variables 🧿

Please use 'tcptrace -hfilter' for the complete listing of filter variables.

🧿 Filter Syntax 🧿

Please use 'tcptrace -hfilter' for filter syntax.

🌍 ENVIRONMENT 🌍

Options are first read from the file $HOME/.tcptracerc (if it exists), and then from the environment variable TCPTRACEOPTS (if it exists), and finally from the command line.

👑 AUTHOR 👑

Shawn Ostermann (ostermann@cs.ohiou.edu)

💖 CREDITS 💖

Thanks to Mark Foster (mafoster@george.arc.nasa.gov) for writing this manual page. Thanks to Avinash Lakhiani (alakhian@irg.cs.ohiou.edu) for updating it.

📂 FILES 📂

🗂️ Dump File Names 🗂️

Trailing (unrecognized) arguments are taken to be one or more filenames. The files can be compressed, see compress.h for configuration. If the dump file name is 'stdin', then we read from standard input rather than from a file.

🔭 SEE ALSO 🔭

  • xplot — an interactive tool for examining .xpl files output by tcptrace.
  • jPlot — a Java version of xplot.

okay bestie, that's the whole page. It was last updated 14 Oct 2002, and it's the tcptrace(1) page from the General Commands Manual. bye bestie, go analyze some TCP connections 💅✨🦋

📦 where this page comes from