tcp.analysis(1)

SYNOPSIS
tcp.analysis [ file ]

DESCRIPTION
DEPRECATED - Replaced by tcpgraph(1).

tcp.analysis is a packet shell script written in Tcl/Tk. It parses snoop capture files and displays the resulting connections. The packet trace of the connection is then converted to xplot input and passed to it for viewing.

Performance of a TCP/IP connection depends on the behavior of the TCP/IP implementations invovled in the connection. This may affect data throughput, efficient use of bandwidth, timely recovery from lost packets, and interaction with other resources in the network.

TCP/IP's robustness can often hide failures, even bugs, of the network and the TCP/IP implementation themselves. TCP/IP's ability to continue to service a connection when things are going wrong allows bugs to remain hidden. Detecting these bugs requires methods of observing and determining the performance of TCP/IP connections. Analysis of a packet trace is often the only method of determining why a TCP/IP connection is behaving or performing oddly.

How to interpret plot

The packet traces are displayed as a time-sequence plot where the horizontal axis is indexed by time and the vertical axis is indexed by sequence number.

Packets sent by the sender are plotted by placing a vertical line segment in time-sequence space starting at the sequence number contained in the sequence field of the packet and extending upwards for the length of the packet. An arrow is affixed to each end of the line segment (to make segments easier to recognize and make it possible to see zero-length segments). Zero length segments appear only as two arrows facing each other, which looks like the letter "X". Location relative to the horizontal axis corresponds to the timestamp on the packet in the trace.

Packets sent by the receiver are plotted by extracting the acknowledgement and window fields, computing an end-of-window number by adding these two fields together, and plotting points at the location of the (time-of-packet, acknowledgement) and (time-of-packet, end-of-window) in the time-sequence space. Space between these two points can be thought of as the window and over-and-up stair steps are plotted from each of the points plotted by the previous inbound packet to the corresponding new point. The stair-step produced by plotting the acknowledgement fields is called the ack line and the region on the plot between the ack line and the line at the end of the window (the window line) can be thought of as the window. To make visible inbound packets which contain the same acknowledgement or window numbers as the previous packet, down tick marks are placed on the ack line and up tick marks window line.

Both these plots are combined to produce the time-sequence plot.

FILES

/opt/psh/bin/tcp.analysis
    /opt/psh/bin/tcp.graph

SEE ALSO
snoop(1M), xplot(1).