trpr.html

trpr是可以分析tcpdump和mgen日志记录

will be accumulated into a matching flow plot and are also tested against
the sets of <u>auto</u>  option criteria so redundant plot lines may result
depending on the criteria used.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">exclude &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>
          <td valign="top" nosave="">This command instructs <i>trpr</i> to
 ignore    specific "flows" which match the given (type,src,dst) criteria.&nbsp;
 The    address and port criteria are given in the same way as for the <u> 
 auto</u>       command and may be wildcarded in the same way.&nbsp; For example,
the   option  "<tt>flow udp</tt>" will cause <i>trpr</i> to ignore all detected
  UDP traffic  (regardless of source and destination since they are implicitly
  wildcarded  here).&nbsp; The <u>exclude</u> command filters are evaluated
  before the       <u>auto</u> and <u>flow</u> command filters.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">input &lt;inputFile&gt;</td>
          <td>This option instructs <i>trpr</i> to use the file name given
 by  &lt;inputFile&gt;   for input.&nbsp; Otherwise <i>trpr</i> looks for
input  from <tt>stdin</tt>   .&nbsp; The expected input format is&nbsp; text
output  from the <i>tcpdump</i>    program run with its hexadecimal option
(-x) given  and properly filtered   so that only IP protocol data is captured.&nbsp; 
 Non-IP data from <i>tcpdump</i>    will result in errors in <i>trpr</i>'s 
 output.</td>
         </tr>
          <tr nosave="">
         <td valign="top" nosave="">output &lt;outputFile&gt;</td>
          <td>This option instructs <i>trpr</i> to save cumulative data into
  the  file name given by &lt;outputFile&gt; for later (non-real-time) plotting.&nbsp; 
    The plot data stored here contains data from the entire <i>tcpdump</i> 
   run  (as opposed to the <i>trpr</i> real-time mode's limited <u>history</u> 
    of  data).&nbsp; By default (i.e. unless the <u>raw</u> option is given), 
  the  output file contains text header information at its beginning so that 
        <u>   gnuplot</u> can be used to create a nicely-labelled graph.&nbsp;</td>
         </tr>
          <tr>
              <td valign="top">link &lt;src&gt;[,&lt;dst&gt;]<br>
              </td>
              <td valign="top">This causes <i>trpr </i>to process only packets
   associated  with the identified "link" or "node". &nbsp;For <i>ns </i>trace
   files, the  &lt;src&gt; and &lt;dst&gt; values correspond to simulation
 node  identifiers.  &nbsp;For <i>tcpdump </i>operation, the MAC address
is  used.  &nbsp;Note that  &lt;src&gt; and/or &lt;dst&gt; values can be
wildcarded   by omission or by  designating 'X' as the value. &nbsp;For <i>n</i>s
simulations    &nbsp;using  the wireless/mobility extensions, the &lt;dst&gt;
value may   be "AGT" or "RTR"  corresponding to the wireless transmission
type (By default,    both "AGT" and"RTR"  are counted by <i>trpr) </i>since
the notion of "links"    is not used in the  trace files. &nbsp;Wildcarding
the &lt;src&gt; or &lt;dst&gt;    values allows  the user to analyze all
traffic arriving to and/or leaving    from a specific  simulation node or
MAC address. &nbsp;The <u>send</u> and         <u>recv</u> commands  may
be optionally used in combination with the         <u>link</u> command to
specify  whether only arriving packets (<u>   recv</u>  ) or departing packets
(<u>send</u>  ) are processed. &nbsp;By   default, both arriving and departing
packets are  processed.<br>
              </td>
            </tr>
            <tr>
              <td valign="top">send<br>
              </td>
              <td valign="top">Specifies that only "sent" packets are to
be  processed.   &nbsp;In <i>ns</i>, this corresponds to 's' events for traced 
 links or nodes.   &nbsp;In <i>tcpdump</i>, this corresponds to packets whose 
 source MAC address   correspond to the &lt;src&gt; value given with the 
     <u>  link</u>  command. &nbsp;By  default, both "sent" and "received" 
packets  are counted by <i>trpr</i> . &nbsp;The        <u>send</u> &nbsp;and 
      <u>recv</u>   commands are generally  useful only  for <i>ns </i>simulations 
but may be applicable to <i>tcpdump</i>   trace file  analysis in some situations.<br>
              </td>
            </tr>
            <tr>
              <td valign="top">recv<br>
              </td>
              <td valign="top">Specifies that only "received" packets are 
to  be  processed. &nbsp;In <i>ns</i>, this corresponds to 'r' events for 
traced   links or nodes. &nbsp;In <i>tcpdump</i>, this corresponds to packets 
whose   destination MAC address corresponds to the &lt;dst&gt; value given 
with the        <u> link</u> command. &nbsp;By default, both "sent" and "received" 
 packets are counted by <i>trpr</i> . &nbsp;The <u>send</u> &nbsp;and <u> 
recv</u>    commands are generally useful only for <i>ns </i>simulations but
may be  applicable  to <i>tcpdump</i> trace file analysis in some situations.<br>
              </td>
            </tr>
            <tr nosave="">
         <td valign="top" nosave="">range &lt;startSec&gt;[:stopSec]</td>
          <td>Causes <i>trpr</i> to skip ahead to the "start time" (in seconds) 
   from  the first packet event in the trace file and end processing at the 
  optional  "stop time" (in seconds).&nbsp; Setting the "stop time" to -1 
causes        <i>trpr</i>  to process until the end of the trace input. &nbsp;Note 
  the       <u>range </u> command may be used in combination with the <u> 
offset         </u> and/or <u>absolute       </u>commands to perform analysis 
for  a specific time period in the trace file.</td>
         </tr>
          <tr>
              <td valign="top">offset &lt;hh:mm:ss&gt;<br>
              </td>
              <td valign="top">This allows the user to specify an absolute
 analysis    start time using a time-of-day reference. &nbsp;The time given
 is in 24-hour    clock time format and must be within 12 hours of the time
 of the first packet   event in the trace file.<br>
              </td>
            </tr>
            <tr>
              <td valign="top">absolute<br>
              </td>
              <td valign="top">Causes <i>trpr </i>to use the absolute time
 given    in the trace file in its output instead of "normalizing" the time
 values   (generally the plots' x-axis) to zero time for the first packet
event or  optional       <u> off</u>set time.<br>
              </td>
            </tr>
            <tr>
              <td valign="top">summary<br>
              </td>
              <td valign="top">This causes <i>trpr</i> to output summary
statistics     of results to <i>stdout</i> at the end of analysis. &nbsp;These
summary   results  are available with or without the production of data intended
for   plotting.<br>
              </td>
            </tr>
            <tr>
              <td valign="top">histogram<br>
              </td>
              <td valign="top">This causes <i>trpr</i> to output a histogram
  of  the values of analyses intervals (intervals determined by the window
 command)   for each flow to <i>stdout</i>. &nbsp;Some percentile information
 of the  histogram content is also provided in the output. &nbsp;The histograms
 are  comma-delimited tables of values. &nbsp;Currently the quantization
size  and  curve of the histogram is fixed and adapts in range with data.
&nbsp;The   histogram output may be useful for packet <u>latency</u> analyses.<br>
              </td>
            </tr>
            <tr>
         <td>replay &lt;factor&gt;</td>
          <td>This limits <i>trpr</i>'s rate of real-time <i>gnuplot </i>graph
   generation  to a &lt;factor&gt; of&nbsp; real time when parsing a pre-existing
   trace file.&nbsp; When the <u>replay</u> command is given, <i>trpr</i>
generates   the same gnuplot output as for the <u>real</u> command.&nbsp;
The &lt;factor&gt;   parameter scales the playback rate with respect to real
time.&nbsp; For example,  &lt;factor&gt; = 1 is actual real time, while &lt;factor&gt;
= 2 is double  speed playback.&nbsp; Note that real time update occurs once
 per <u>window</u>     time.</td>
         </tr>
                                 
  </tbody>        
</table>
          <br>
        &nbsp;         
<h3> <i>tcpdump</i> Hints:</h3>
         1)&nbsp;&nbsp;&nbsp; Make sure you are using <i>tcpdump</i> filters
  such   that only IP packets are captured (<i>trpr</i> currently doesn't
<br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; like non-IP packets in 
<i>   tcpdump</i>    's output).         
<p>2)&nbsp;&nbsp;&nbsp; Always use the "-x" option when using <i>tcpdump</i> 
        with <i>trpr</i>.&nbsp; (<i>trpr</i> looks for and parses the hexadecimal 
    output) </p>
               
<p>3)&nbsp;&nbsp;&nbsp; Use <i>tcpdump</i>'s "-n" option to skip DNS lookups 
    and speed up <i>tcpdump</i>'s performance (<i>trpr</i> only uses dotted 
  <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; decimal numeric IP addresses). 
    </p>
               
<p>4)&nbsp;&nbsp;&nbsp; Use <i>tcpdump</i>'s line buffering option ("<tt> 
       -l"</tt>)&nbsp; to get output with minimal delay for real time plotting. 
   </p>
               
<p>5)&nbsp;&nbsp;&nbsp; Read and learn <i>tcpdump</i>'s man page for the extensive
set of filtering options <i>tcpdump</i> provides.&nbsp; Uses these <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; filter options in conjunction 
   with  <i>trpr</i>'s own filters to get the graphical results you want. 
</p>
               
<p>6)&nbsp;&nbsp;&nbsp; Leverage <i>tcpdump</i>'s ability to store captured 
    data in a binary file (use tcpdump's "-w" option) and then <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; post-process it with <i> 
 tcpdump</i>      's filter's (using <i>tcpdump</i> to process the stored
 binary file with   its "<tt>-r</tt>" option <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; and redirecting its output&nbsp; 
    to <i>trpr</i>). <br>
        &nbsp; </p>
               
<h3> <i>gnuplot</i> Hints:</h3>
                  
<p><br>
        1)&nbsp;&nbsp;&nbsp; Use <i>gnuplot</i>'s "<tt>-noraise</tt>" option
  when   using with <i>trpr</i> in "real-time" mode if you don't want the
updated   <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; plots to continually pop 
 to  your  display's top level. </p>
               
<p>2)&nbsp;&nbsp;&nbsp; Use <i>gnuplot</i>'s "<tt>-persist</tt>" option if
    you wish the last plot to remain displayed after exiting. </p>
               
<p>3)&nbsp;&nbsp;&nbsp; <i>trpr</i>'s output files for <i>gnuplot</i> are 
    in text format and easily edited to customize output.&nbsp; <i>Gnuplot</i> 
        is a very flexible <br>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; program with lots of options 
   to get the graphs into almost any format you would like.&nbsp; It is also 
   lightning fast. <br>
        &nbsp; </p>
               
<h2> Examples of Use:</h2>
         (TBD) <br>
        &nbsp;         
<h2> Credits:</h2>
         <i>trpr</i> was written by:         
<p>Brian Adamson <br>
        <a href="mailto://[e-mail]">[e-mail]</a> 
        </p>
               
<p>Your questions and comments are welcome and appreciated. (30 July 2002) 
    <br>
        &nbsp; <br>
        &nbsp; </p>
               <br>
</body>
</html>