Packet Capture, part 3: Analysis Tools - Page 3
1.5.4. tcp-reduce
The program tcp-reduce invokes a collection of shell scripts to reduce the packet capture information in a tcpdump trace file to one-line summaries for each connection. That is, an entire Telnet session would be summarized by a single line. This could be extremely useful in getting an overall picture of how the traffic over a link breaks down or for looking quickly at very large files.
The syntax is quite simple.
bsd1# tcp-reduce tracefile > outfile
will reduce tracefile, putting the output in outfile. The program tcp-summary, which comes with tcp-reduce, will further summarize the results. For example, on my system I traced a system briefly with tcpdump. This process collected 741 packets. When processed with tcp-reduce, this revealed 58 TCP connections. Here is an example when results were passed to tcp-summary :
bsd1# tcp-reduce out-file | tcp-summary
This example produced the following five-line summary:
proto # conn KBytes % SF % loc % ngh ----- ------ ------ ---- ----- ----- www 56 35 25 0 0 telnet 1 1 100 0 0 pop-3 1 0 100 0 0
In this instance, this clearly shows that the HTTP traffic dominated the local network traffic.
1.5.5. tcpshow
The program tcpshow decodes a tcpdump trace file. It represents an alternative to using tcpdump to decode data. The primary advantage of tcpshow is much nicer formatting for output. For example, here is the tcpdump output for a packet:
12:36:54.772066 sloan.lander.edu.1174 > 205.153.63.238.telnet: . ack 3259091394 win 8647 (DF) b
Here is corresponding output from tcpshow for the same packet:
----------------------------------------------------------------------- Packet 1 TIME: 12:36:54.772066 LINK: 00:10:5A:A1:E9:08 -> 00:10:5A:E3:37:0C type=IP IP: sloan -> 205.153.63.238 hlen=20 TOS=00 dgramlen=40 id=B30C MF/DF=0/1 frag=0 TTL=128 proto=TCP cksum=2D84 TCP: port 1174 -> telnet seq=0016775603 ack=3259091394 hlen=20 (data=0) UAPRSF=010000 wnd=8647 cksum=E869 urg=0 DATA: <No data> -----------------------------------------------------------------------
The syntax is:
bsd1# tcpshow < trace-file
There are numerous options.
- « Previous Page
- 1
- 2
- 3
- 4
- 5
- 6
- Next Page »