tcpdump manual

Click here to load reader

Post on 08-Apr-2015

676 views

Category:

Documents

5 download

Embed Size (px)

TRANSCRIPT

TCPTRACE Manual

Manikantan Ramadas mramadas@irg.cs.ohiou.edu

24 August 2003

Copyright c 2003 Internetworking Research Group, Ohio University. All rights reserved.

Abstract This manual documents the general usage of the tcptrace program. tcptrace is a TCP Connection Analysis Tool originally written by Dr.Shawn Ostermann at Ohio University. It is maintained these days by his students and members of the Internetworking Research Group (IRG) at Ohio University.

CONTENTS

1 Preface 2 Getting Started 2.1 Installing tcptrace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Using tcptrace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Basic Usage 4 Detailed Usage 4.1 Detailed Stats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 RTT Stats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 CWND Stats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Graphing 5.1 Time Sequence Graph . 5.2 Throughput Graph . . . 5.3 RTT Graph . . . . . . . 5.4 Outstanding Data Graph 5.5 Segment Size Graph . . 5.6 Time-Line Graph . . . 5.7 Miscellany . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1 3 3 3 5 7 7 10 13 15 15 24 24 24 28 28 29

6 Filtering Connections 33 6.1 Basic Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 6.2 Advanced Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 7 Extended Options 39 7.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 7.2 Graphing Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 7.3 Warning Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 8 Miscellany 8.1 UDP Analysis . . . 8.2 Real-Time Analysis 8.3 Packet Details . . . 8.4 Other Miscellany . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 45 46 47 48

9 Modules 51 9.1 TRAFFIC Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 9.2 HTTP Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

i

9.3 9.4 9.5 9.6

SLICE Module . . COLLIE Module Real-Time Module Writing Modules .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

63 67 68 69 73 77 79 81

A Arguments QR B XPLOT QR C Protocol QR D License

ii

CHAPTER

ONE

PrefaceThe goal of this manual is to document the tcptrace program; to explain how to get it installed, explain its capabilities, how to get it do all it can do, what all the output it generates mean, and how they are calculated, etc. However, the goal is not to explain the working of the TCP/IP protocol suite itself, and there are nice books that do this already. I recommend my favorite book [?] if you need to understand the TCP/IP protocol suite better, or if commonly used TCP/IP parlance like SACK, CWND, pure ACK etc., are not familiar to you. The manual is organized into chapters with the goal of making them as modular as possible so that they can be read independently of one another. It consists of the following chapters : Getting Started Explains how to get tcptrace up and running on your system, and the details from the environment that tcptrace uses. Basic Usage Explains the basic output generated by tcptrace . Detailed Usage Explains how to perform more detailed analysis, and the elds in the long output format. Graphing Explains the graphs that can be generated, and how to generate them. Filtering Connections Explains how to lter-out or lter-in the connection(s) of interest. Extended Options Explains what each of the extended options mean and how to turn them on/off. Miscellany Explains all the miscellaneous things the program can do, like minimal UDP analysis, printing out packet details, etc. Modules Explains the behavior of the modules distributed with tcptrace , and briey on how to write your own modules. If you are a tcptrace Power-user familiar with the program, and are just looking for the option that generates the output you need, you might dive straight into Appendix A: Arguments Quick Reference. You may nd answers to some of your xplot related questions in Appendix B: XPLOT Quick Reference. The syntactical denitions of common protocol headers are provided in Appendix C Protocol Quick Reference. Finally, in a slight abuse of parlance, the terms segments and packets have been used interchangeably in the manual. However it would be clear from context, for e.g., if we say TCP packets we mean TCP segments. Hopefully it would not be a cause of concern. Thanks Thanks are due to my friend Avinash S. Lakhiani for working on an earlier version of the manual and for getting the Documentation project kick-started. Some sections of the manual have been drawn directly from his A manuscript. Thanks are also due to the Python Software Foundation for the LTEX 2 style les from the Python Documentation Project used for generating this manual.

1

2

CHAPTER

TWO

Getting Started2.1 Installing tcptrace

tcptrace can be downloaded from the project web-site http://www.tcptrace.org/download.html . Installing the stable version of tcptrace follows the typical procedure used to install most open-source software on UNIX-based systems. Unzip and Untar the tar-ball (tcptrace-X.Y.Z.tar.gz) with the following steps : gunzip tcptrace-X.Y.Z.tar.gz tar xvf tcptrace-X.Y.Z.tar Now, enter the tcptrace-X.Y.Z directory and install tcptrace with the following steps : ./congure make make install (as super-user) You may also download cutting-edge version of tcptrace from the projects CVS repository. Instructions for doing so may be found in the download page at http://www.tcptrace.org/download.html . A port of the tcptrace program has also been made to the Windows platforms. However windows ports tend only to be made for stable releases of the program. More information on the Windows version of the program can be found in : http://www.tcptrace.org/windows.html .

2.2

Using tcptrace

tcptrace can be run on a network dumple trivially as intcptrace dumpfile

where dumpfile is a le containing trafc captured from the network. tcptrace understands various network dumple formats like tcpdump, snoop, etherpeek, netm, ns, nlanr, netscout. Dumples in these formats can also be compressed in GnuZIP (gz), BZIP2 (bz2), or UNIX compress (Z) formats, as tcptrace can uncompress them on the y. tcptrace can be passed multiple command-line options to perform various tasks as explained in subsequent chapters. If you want tcptrace to always start processing with certain command-line options, you may store them in .tcptracerc le in your home directory, or set the TCPTRACEOPTS environment variable with the options. tcptrace reads the

3

.tcptracerc le and the TCPTRACEOPTS environment variable before processing options given in commandline. You may also use tcptrace -h to get brief descriptions of various command-line options.

4

Chapter 2. Getting Started

CHAPTER

THREE

Basic UsageWhen tcptrace is run trivially on a dumple, it generates output similar to the following :

Beluga:/Users/mani> tcptrace tigris.dmp 1 arg remaining, starting with tigris.dmp Ostermanns tcptrace -- version 6.4.5 -- Fri Jun 13, 2003 87 packets seen, 87 TCP packets traced elapsed wallclock time: 0:00:00.037900, 2295 pkts/sec analyzed trace file elapsed time: 0:00:12.180796 TCP connection info: 1: pride.cs.ohiou.edu:54735 - elephus.cs.ohiou.edu:ssh (a2b) 2: pride.cs.ohiou.edu:54736 - a17-112-152-32.apple.com:http (c2d)

30> 12>

30< 15 elephus.cs.ohiou.edu) and 30 packets were seen in the b2a direction (elephus.cs.ohiou.edu ==> pride.cs.ohiou.edu). The two connections are reported as complete indicating that the entire TCP connection was traced i.e., SYN and FIN segments opening and closing the connection were traced. TCP connections may also be reported as reset if the connection was closed with an RST segment, or unidirectional if trafc was seen owing in

View more