This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.

TCPCollector Element Documentation

NAME

TCPCollector -- Click element; collects information about TCP flows

SYNOPSIS

TCPCollector([TRACEINFO, keywords TRACEINFO, SOURCE, NOTIFIER, IP_ID, PACKET, FULLRCVWINDOW, WINDOWPROBE, INTERARRIVAL])

Ports: 1 input, 1-2 outputs
Processing: agnostic, but output 1 is push
Drivers: userlevel
Package: models

DESCRIPTION

Expects TCP packets with aggregate annotations set as if by AggregateIPFlows. Packets must have timestamps in increasing order. Collects information about the TCP connections, including a small record for every packet, and can optionally write that information to an XML file. Other elements can call TCPCollector methods to write other information to the XML file, or to attach more data to each packet record or connection record. Keywords are:

TRACEINFO
Filename. If given, then output information about each aggregate to that file, in an XML format. See below for an example.
SOURCE
Element. If provided, the results of that element's 'filename' and 'packet_filepos' read handlers will be recorded in the TRACEINFO dump. (It is not an error if the element doesn't have those handlers.) The 'packet_filepos' results may be particularly useful, since a reader can use those results to skip ahead through a trace file. 'filename' is stored as a file attribute on the trace element, and 'packet_filepos' is stored as filepos attributes on any flow elements.
NOTIFIER
An AggregateNotifier element, such as AggregateIPFlows. TCPCollector registers with the notifier to receive "delete aggregate" messages. It uses these messages to delete state. If you don't provide a NOTIFIER, TCPCollector will keep some state for every aggregate it sees until the router quits.
IP_ID
Boolean. If true, then use IP ID to distinguish network duplicates from retransmissions. Default is true.
PACKET
Boolean. If true, then write summaries of each data packet to the TRACEINFO file, in "<packet>" elements nested inside each "<stream>". Each line has the format "timestamp seq seqlen ack", where timestamp is the packet's timestamp, seq its initial sequence number, seqlen its sequence number length, and ack its acknowledgement number. Default is false.
FULLRCVWINDOW
Boolean. If true, then write summaries of any data packets that fill the receiver's advertised window to the TRACEINFO file, in "<fullrcvwindow>" XML elements nested inside each "<stream>". Each line has the format "timestamp endseq", where timestamp is the packet's timestamp and endseq is its end sequence number. Default is false.
WINDOWPROBE
Boolean. If true, then write summaries of any window probes to the TRACEINFO file, in "<windowprobe>" XML elements nested inside each "<stream>". Each line has the format "timestamp endseq", where timestamp is the packet's timestamp and endseq is its end sequence number. Default is false.
INTERARRIVAL
Boolean. If true, then write packet interarrival times to the TRACEINFO file, in "<interarrival>" XML elements nested inside each "<stream>". Each line is an interarrival time in microseconds. Default is false.

EXAMPLES

This configuration collects information from a tcpdump(1) file specified on standard input, and writes an XML summary to tcpinfo.xml.

   require(models);
   d :: FromDump(-, STOP true, FORCE_IP true)
      -> IPClassifier(tcp)
      -> a :: AggregateIPFlows
      -> TCPCollector(tcpinfo.xml, SOURCE d, NOTIFIER a)
      -> Discard;

After it runs, tcpinfo.xml might look like this:

   <?xml version='1.0' standalone='yes'?>
   <trace file='<stdin>'>
   <flow aggregate='1' src='146.164.69.8' sport='33397' dst='192.150.187.11' dport='80' begin='1028667433.955909' duration='131.647561' filepos='24'>
     <stream dir='0' ndata='3' nack='1508' beginseq='1543502210' seqlen='748' sentsackok='yes'>
     </stream>
     <stream dir='1' ndata='2487' nack='0' beginseq='2831743689' seqlen='3548305'>
     </stream>
   </flow>
   </trace>

ELEMENT HANDLERS

clear (write-only)
Erase TCPCollector's internal state. All current connections are erased (and output to the XML traceinfo file buffer, if appropriate).
flush (write-only)
Flush TCPCollector's XML traceinfo file buffer.

SEE ALSO

AggregateIPFlows, MultiQ

Generated by 'click-elem2man' from 'package/tcpcollector.hh:17' on 17/Jan/2012.

COMMENTS

 
elements/tcpcollector.txt · Last modified: 2012/01/17 10:23 (external edit)
 
Recent changes RSS feed Driven by DokuWiki