#Install tcpdump and tcptrace install
#Install tcpdump and tcptrace download

rexmt data pkts РІР‚вЂњ total number of packets that where retransmittions.

actual data bytes РІР‚вЂњ total number of bytes seen including retransmittion.

actual data pkts РІР‚вЂњ total number of packet with at least 1 byte of TCP payload.

unique bytes sent РІР‚вЂњ total number of bytes sent excluding retransmittions.

max sack blks/ack РІР‚вЂњ maximum number of selective ACK blocks seen in any selective ACK packet.

dsack pkts sent РІР‚вЂњ number of duplicate selective ACKs sent in that direction.

sack pkts sent РІР‚вЂњ number of selective ACKs sent in that direction.

pure acks sent РІР‚вЂњ number of ACK sent without data and the SYN,FIN&RST not set.

ack pkts sent РІР‚вЂњ number of ACKs sent in that direction.

total packets РІР‚вЂњ number of packets sent in that specific direction.IРІР‚в„ўm now going to explain each label given in long output (warning. When viewing the output from the long mode (when -l is the option) then all information is labelled. When adding options to TCPtrace, you need to ensure the you place the extra options before the name of the input file and after the tool name. When using TCPdump, you can see more detailed output using the РІР‚В-vРІР‚в„ў option but with TCPtrace you can see more detailed output using the РІР‚В-lРІР‚в„ў option.

Just like TCPdump, you can stop the translation of IP address to domain names using the РІР‚В-nРІР‚в„ў opinion.

Then the connection is labelled with РІР‚В(complete)РІР‚в„ў or РІР‚В(reset)РІР‚в„ў, with the connection being labelled as complete if SYN and FIN packets were seen.

The number proceeding РІР‚В<РІР‚В is the number of packets seen in the second host to the first host direction.

The number proceeding РІР‚В>РІР‚в„ў is the number of packets seen in the first host to second host direction.

Then is the label given to this connection by TCPtrace is printed in parenthesis.

First it gives the address and ports of the two machines involved in the connection.

The sequential lines contain information on each TCP connection.

The following line gives the trace file elasped time, this is the time between the capture of the first packet and the last packet in the file.

The following line gives the elapsed wallclock time, this is the time TCPtrace took to process the file and it then gives the average number of packets processed by TCPtrace per second.

The next line states the number of packets seen and the number of those which were TCP.

Then it printed the version of TCPtrace and then this version was last compiled.

1st line returns the name of the TCPdump output file that TCPtrace is currently analyzing.

The structure of the output is (in order from the top) : The above will run TCPdump and create the output file called РІР‚Сљmy_tcpdump_outputРІР‚Сњ, this file is then passed as a argument to the TCPtrace tool How do i interpret the basic TCPtrace output ? $ sudo tcpdump -v -i wlan0 -w my_tcpdump_output -c 100 You can call TCPtrace with a TCPdump file using РІР‚Вtcptrace РІР‚В where my-file is the name of the file outputted by TCPdump. How do I input a TCPdump file to TCPtrace ?

#Install tcpdump and tcptrace download

If this is not possible you can download it from here.

#Install tcpdump and tcptrace install

I downloaded it from the Ubuntu repositories using the typical РІР‚Вsudo apt-get install tcptraceРІР‚в„ў. So TCPtrace takes the output file from TCPdump as an input and it then outputs useful information and graphs. Previously, in my introduction to TCPdump I highlighted that the output logs created by TCPdump were not plain text and only special programs could interpret them, TCPdump is one of these program, as is Wireshark and TCPtrace. 'GROK_TCPDUMP' out of Makefile.Its a tool designed to analyze the output logs from TCPdump. If you don't HAVE this package and don't CARE about it, then comment

If tcpdump was installed correctly, then you're probably all set. Need to have already installed the pcap library (see README.pcap). If you want to be able to read tcpdump format files, then you'll OK, to the best of my knowledge, you should be able to get tcptrace to Learn more about bidirectional Unicode characters To review, open the file in an editor that reveals hidden Unicode characters. This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below.