trpr.html

trpr是可以分析tcpdump和mgen日志记录

        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [flow &lt;type,srcAddr/port,dstAddr/port&gt;,flowId]</tt> 
        <br>
        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [exclude &lt;type,srcAddr/port,dstAddr/port&gt;,flowId]</tt> 
        <br>
        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [input &lt;inputFile&gt;] 
   [output &lt;outputFile&gt;</tt><tt>]<br>
         &nbsp; &nbsp; &nbsp; &nbsp; </tt><tt>[link &lt;src&gt;[,&lt;dst&gt;]][send
    | recv]<br>
         &nbsp; &nbsp; &nbsp; &nbsp; </tt><tt>[range [&lt;startSec&gt;][:&lt;stopSec&gt;]][offset
    &lt;hh:mm:ss&gt;]<br>
        &nbsp; &nbsp; &nbsp; &nbsp; [summary][histogram][replay &lt;factor&gt;]</tt> 
        <br>
        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [png &lt;pngFile&gt;][post 
    &lt;postFile&gt;][multiplot][ramp][alimit &lt;bytes&gt;]</tt> <br>
        &nbsp; </p>
               
<p>&nbsp;NOTE:&nbsp;&nbsp;&nbsp; T<i>ype, addr, or port parameters can be
    "wildcarded" with an 'X' character.</i> <br>
        &nbsp; </p>
               
<h3> Command Line Parameters and Options:</h3>
         &nbsp;         
<table width="100%" nosave="">
         <tbody>
            <tr nosave="">
         <td valign="top" width="30%" nosave="">version</td>
          <td>Causes <i>trpr</i> to display program version number and exit.</td>
         </tr>
          <tr>
         <td>drec</td>
          <td><i>trpr</i> will expect to process a <i>drec</i> log file instead 
   of        <i>tcpdump</i> hex output.</td>
         </tr>
          <tr>
              <td valign="top">ns<br>
              </td>
              <td valign="top"><i>trpr</i> will expect to process a <i>ns</i> 
    trace  file instead of <i>tcpdump</i> hex output.<br>
              </td>
            </tr>
            <tr nosave="">
         <td valign="top" nosave="">raw</td>
          <td>When this option is given, the &lt;outputFile&gt; will only 
include    unlabeled sets of plotting data without the default <i>gnuplot</i> 
 compatible    headers.&nbsp; This is useful to get the "raw" plot data for 
importing into   a spreadsheet or other plotting program.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">key</td>
          <td>With this option, trpr will print a "key" to the data plot
sets   in  the &lt;outputFile&gt;.&nbsp; This consists of one comma-delimited 
line   with  a leading "#" character.&nbsp; This line is printed when new 
flows  of data  are detected and another data set column is output.&nbsp; 
The first   column  is marked "Time".&nbsp; Subsequent columns are labeled 
with a description    of the flow data being plotted.</td>
         </tr>
          <tr>
         <td valign="top">rate<br>
         </td>
         <td valign="top">Causes <i>trpr</i> to create plots of data rate 
versus  time. &nbsp;The <u>window</u>     command  can be used to set <i> 
trpr</i>  's rate averaging window.&nbsp;  The <u>rate </u>command is the 
implicit  default plot mode for <i>trpr.</i><br>
         </td>
       </tr>
       <tr nosave="">
         <td valign="top" nosave="">interarrival</td>
          <td>Causes <i>trpr</i> to create plots of differential interarrival 
  packet   delays for detected flows instead of the default data rate versus 
  time plot.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">latency</td>
          <td>Causes <i>trpr</i> to create plots of transmission delay for
       <i>   drec</i>    flows instead of the default data rate versus time
 plot.&nbsp;  This type   of plot is only available for <i>drec</i> operation.</td>
         </tr>
          <tr>
         <td>loss</td>
          <td>Causes <i>trpr</i> to create plots of packet loss based on
received  sequence numbers for <i>drec</i>    flows  instead of the default
data rate  versus time plot.&nbsp; This type   of plot  is only available
for <i>drec</i>    operation.&nbsp; The <u>window</u>     command  can be
used to set <i> trpr</i>  's loss averaging window.&nbsp;  The "window" 
specified should be large  enough to encompass several expected   packet
events  for desired results.</td>
         </tr>
          <tr>
         <td valign="top">count<br>
         </td>
         <td valign="top">Causes <i>trpr</i> to create plots of packet counts 
 versus time instead of the default data rate versus time plot. &nbsp;The 
      <u>window</u>     command  can be used to set <i>trpr</i>'s count accumulation 
 window.&nbsp;  The <u>rate </u>command is the implicit default plot mode 
for       <i>trpr.</i><br>
         </td>
       </tr>
       <tr nosave="">
         <td valign="top" nosave="">real</td>
          <td>When this option is given, <i>trpr</i> will output plotting 
commands     and data to its <tt>stdout</tt>.&nbsp; This output is intended 
for the        <tt>   stdin</tt> of gnuplot for real-time plotting.&nbsp; 
However,  note that this  output can be redirected to a file for storage, 
and then later that file can be directed to the input of <i>gnuplot</i> for 
"playback".&nbsp;   Note that the "real-time" mode can be used simultaneously 
with <i>trpr</i>     's cumulative  "non-real-time" <u>output</u> option.&nbsp; 
Note that the   "real time" graph&nbsp;  update occurs once per <u>window</u> 
 time.&nbsp;   This option can also be used with pre-existing trace files.&nbsp; 
Use the   replay command to limit the actual graph animation rate or the trace
file   will be parsed at "cartoon rate" (i.e. as fast as possible).</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">gif &lt;gifFile&gt;</td>
          <td>This option commands <i>gnuplot</i> to create a "gif" (Graphics 
  Interchange   Format) file when it plots instead of the default X11 display.&nbsp; 
  The  &lt;gifFile&gt; parameter is the name of the file <i>gnuplot</i> will 
  create  when it processes       <i>trpr</i>'s output.&nbsp; This can be 
used  in either  real-time or non-real-time operation.&nbsp; In real-time 
operation,  the &lt;gifFile&gt;  will be periodically overwritten according 
to <u>window</u>    setting.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">post &lt;postFile&gt;</td>
          <td>This option commands <i>gnuplot</i> to create a Postscript
file   when   it plots instead of the default X11 display.&nbsp; The &lt;postFile&gt; 
  parameter  is the name of the file <i>gnuplot</i> will create when it processes 
        <i>trpr</i> 's output.&nbsp; This can be used in either real-time 
or  non-real-time operation.&nbsp;  In real-time operation, the &lt;postFile&gt; 
  will be periodically overwritten  according to <u>window</u> setting.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">multiplot</td>
          <td valign="top" nosave="">With <i>gnuplot</i>, <i>trpr</i> will
 create    a "multiplot" graph with one graph per detected flow (stacked
vertically).     (This only works with the real-time upated (<u>real</u>
command) graphing     mode for now).</td>
         </tr>
          <tr>
          <td valign="top">ramp<br>
          </td>
          <td valign="top">By default, <i>trpr </i>creates "stair step" plots
  of its averaging <u>window</u> results (i.e. 2 data &nbsp;points per window).
  &nbsp;The optional <u>ramp </u>command causes <i>trpr </i>to create plots
  with one data point per averaging window (at the window's end), thus "ramping"
  from one window to the next. &nbsp;This may be useful for alternative post-processing
  of <i>trpr</i>'s output files or to reduce the number of data points on
plots  with an extremely large number of data points where the <u>window</u>
 start/stop  points are indiscernable anyway.<br>
          </td>
        </tr>
             <tr nosave="">
         <td valign="top" nosave="">window &lt;sec&gt;</td>
          <td>This parameter sets the step size of <i>trpr</i>'s window-based 
  data   rate and packet loss averaging algorithms.&nbsp; The step size unit 
  is time  in seconds.&nbsp; This algorithm counts the cumulative quantity 
 of data (or  packet loss) in each window of time and calculates the kilobits-per-second 
    (kbps)&nbsp; (or loss fraction) value for each step.&nbsp; These discrete 
    values of data rate (or loss fraction) versus time comprise <i>trpr</i> 
    's   plot data.&nbsp; Two points are plotted, one at each time window's
  beginning   and one at its end, to form a "stair step" plot.&nbsp; The
      <u>    window</u>    command also controls the <i>gnuplot</i> real-time
graph  update  rate for&nbsp;        <u> real</u> command operation.&nbsp;
The <u>  window</u>   &lt;sec&gt;  value can  be specified as "-1" to cause
      <i>trpr</i>   to average  across the  entire trace file (or the period
specified by the        <u>range</u>   command).&nbsp;  Note the negative
      <u>window</u> value  should <b>not</b>   be used in combination  with
the <u>real</u> command.        <br>
        Default = 1 second.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">history &lt;sec&gt;</td>
          <td>This parameter determines the range (in time units of seconds)
  of  the  X-axis of the graphs produced in <i>trpr</i>'s real-time mode.&nbsp; 
   As time progresses, the <i>gnuplot</i> graphs will scroll in "strip-chart" 
   fashion to display the current <u>history</u> of network activity. <br>
        Default = 20 seconds.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">auto &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>
          <td>This command instructs <i>trpr</i> to automatically discover
 and   plot  "flows" of network data according to the matching (type,src,dst,id)
  criteria   provided.&nbsp; Otherwise, <i>trpr</i> only plots "flows" given
  by the       <u>   flow</u> option described below.&nbsp; Valid values
for   &lt;type&gt; include  "X", "udp", "tcp", or the numeric value of the
IP protocol  type of interest.&nbsp;   The "X" value "wildcards" the &lt;type&gt;
so that        <i> trpr</i> will automatically   create a plot on the graph
for any  type of IP protocol which meets the given  &lt;source,destination
&gt; criteria.&nbsp;  The source and destination addresses  (srcAddr &amp;
dstAddr) must be given  in dotted decimal notation or may also  be wildcarded
with an "X" character.&nbsp;  The &lt;source,destination&gt;   portion may
also be omitted and then will  be automatically wildcarded.&nbsp; The optional
 "id" portion of the flow description corresponds to any "flow id" which
may  apply to the data analyzed. &nbsp;This currently only applies to <u>drec
      </u>log files when the user wishes to additionally differentiate <u> 
 drec</u> flows by their "flow id". &nbsp;(See the <i>mgen       </i>user's
 guide for more information). &nbsp;As an example,   "<tt> auto udp</tt>"
will cause <i>trpr</i>  to enumerate individual plots  for each unique UDP
protocol flow detected regardless of source or destination.&nbsp;   The source
and destination port numbers can be explicitly specified or wildcarded  with
an "X" or implicitly through omission.&nbsp; Note that flows which match
 those given with the       <u>flow</u> option (see below)&nbsp; will not
be tested  against the       <u>auto</u> criteria.&nbsp; The <u> auto</u>
 option may be used  multiple times on the <i>trpr</i> command line to establish
multple sets of automatic flow matchiing criteria (e.g.       <tt>trpr auto
udp auto tcp ...</tt>  ").</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">flow &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>
          <td>This command instructs <i>trpr</i> to look for and plot specific
   "flows"  which match the given (type,src,dst) criteria.&nbsp; All flows
 which  match  the given criteria are accumulated together onto a single
plot  line.&nbsp;   The address and port criteria are given in the same way
as for the <u>auto</u>      command and may be wildcarded in the same way.&nbsp;
 For example, the  option  "<tt>flow udp</tt>" will cause <i>trpr</i> to
accumulate  all detected  UDP  traffic (regardless of source and destination
since they  are implicitly  wildcarded here) into a single plot.&nbsp; Thus
the command  "<tt>trpr flow  udp flow tcp ...</tt>" will produce a graph
with two lines,  one plotting cumulative UDP traffic and the other plotting
cumulative TCP  traffic detected by <i>  tcpdump</i>.&nbsp; As with the <u>auto</u>
option,  the <u>flow</u>    option may be used multiple times on the command
line and may be used in conjunction with the <u>auto</u> option.&nbsp; Flows
of network traffic matching the criteria specified with the <u>flow</u> option