|Wireshark wins over TCPtrace on GUI|
Its a tool designed to analyze the output logs from TCPdump. Previously, in my introduction to TCPdump I highlighted that the output logs created by TCPdump were not plain text and only special programs could interpret them, TCPdump is one of these program, as is Wireshark and TCPtrace.
So TCPtrace takes the output file from TCPdump as an input and it then outputs useful information and graphs.
I downloaded it from the Ubuntu repositories using the typical ‘sudo apt-get install tcptrace’. If this is not possible you can download it from here.
You can call TCPtrace with a TCPdump file using ‘tcptrace ‘ where my-file is the name of the file outputted by TCPdump. For example you could do something like:
$ sudo tcpdump -v -i wlan0 -w my_tcpdump_output -c 100
$ tcptrace my_tcpdump_output
The above will run TCPdump and create the output file called “my_tcpdump_output”, this file is then passed as a argument to the TCPtrace tool
The structure of the output is (in order from the top) :
This output is TCPtrace’s brief output. Just like TCPdump, you can stop the translation of IP address to domain names using the ‘-n’ opinion.
When using TCPdump, you can see more detailed output using the ‘-v’ option but with TCPtrace you can see more detailed output using the ‘-l’ option.
When adding options to TCPtrace, you need to ensure the you place the extra options before the name of the input file and after the tool name.
When viewing the output from the long mode (when -l is the option) then all information is labelled. I’m now going to explain each label given in long output (warning .. this might take a while):
Packets and ACKS
Window scaling / Probing
etc… (sorry I hate leaving things half done, but I really wanted to move on, its in my to-do list)
TCPtrace will generate statistics on RRT when using with the opinions ‘-r’ and ‘-l’. This will give data on RRT including the number of RTT samples found, RTT minimum,RTT maximum, RTT average, RTT standard deviation, RTT from TCP’s hand shake. The same data is then available again for full-sized RTT samples only.