tcptrace(1)

NAME
tcptrace - a TCP connection analysis tool

SYNOPSIS
tcptrace [options] filename

DESCRIPTION
tcptrace takes a tcpdump file specified on the command line (or from standard input) and produces a summarization of the connections.

Options
Output format options

-b  brief output format

-l  long output format

-r  print rtt statistics (slower for large files)

-W  report on estimated congestion window (not generally useful)

-q  no output (if you just want modules output)

Graphing options

-T  create throughput graph[s], (average over 10 segments, see -A)

-R  create rtt sample graph[s]

-S  create time sequence graph[s]

-N  create owin graph[s] (_o_utstanding data on _N_etwork)

-F  create segsize graph[s]

-G  create ALL graphs

Output format detail options

-D  print in decimal

-X  print in hexidecimal

-n  don't resolve host or service names (much faster)

-s  use short names (list "picard.cs.ohiou.edu" as just "picard")

Connection filtering options

-iN ignore connection N (can use multiple times)

-oN only connection N (can use multiple times) (if N is not a number but a file, read list from file instead)

-c  ignore non-complete connections (didn't see syn's and fin's)

-BN first segment number to analyze (default 1)

-EN last segment number to analyze (default last in file)

Graphing detail options

-C  produce color plot[s]

-M  produce monochrome (b/w) plot[s]

-AN Average N segments for throughput graphs, default is 10

-z  zero axis options:

-z  plot time axis from 0 rather than wall clock time (backward compat)

-zx plot time axis from 0 rather than wall clock time

-zy plot sequence numbers from 0 (time sequence graphs only)

-zxy
    plot both axes from 0

-y  omit the (yellow) instantaneous throughput points in tput graph

Misc options

-Z  dump raw rtt sample times to file[s]

-p  print all packet contents (can be very long)

-P  print packet contents for selected connections

-t  'tick' off the packet numbers as a progress indication

-fEXPR
    output filtering (see -hfilter)

-v  print version information and exit

-w  print various warning messages

-d  whistle while you work (enable debug, use -d -d for more output)

-e  extract contents of each TCP stream into file

-h  print help messages

-u  print minimal UDP information too

-Ofile
    dump matched packets to tcpdump file 'file'

+[v]
    reverse the setting of the -[v] flag (for booleans)

Obscure Options

--showsacks
    show SACK blocks on time sequence graphs

--noshowsacks
    DON'T show SACK blocks on time sequence graphs

--showrexmit
    mark retransmits on time sequence graphs

--noshowrexmit
    DON'T mark retransmits on time sequence graphs

--showoutorder
    mark out-of-order on time sequence graphs

--noshowoutorder
    DON'T mark out-of-order on time sequence graphs

--showzerowindow
    mark zero windows on time sequence graphs

--noshowzerowindow
    DON'T mark zero windows on time sequence graphs

Module options

-xMODULE_SPECIFIC
    (see -hxargs for details)

ENVIRONMENT
Options are first read from the file $HOME/.tcptracerc (if it exists), and then from the environment variable TCPTRACEOPTS (if it exists), and finally from the command line.

AUTHOR
Shawn Ostermann ostermann@cs.ohiou.edu

CREDITS
Thanks to Mark Foster for writing this manual page

FILES
Dump File Names
Trailing (unrecognized) arguments are taken to be one or more filenames. The files can be compressed, see compress.h for configuration. If the dump file name is 'stdin', then we read from standard input rather than from a file.

SEE ALSO

xplot
    an interactive tool for examining .xpl files output by tcptrace.