This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.
TCPMystery -- Click element; analyzes TCP flows
TCPMystery(TCPCOLLECTOR [, keywords RTT, SEMIRTT, ACKCAUSATION])
Analyzes TCP flows and dumps various flow information to an XML trace info file. Both the flows and the trace info file are handled through a TCPCollector collector element elsewhere in the connection; TCPMystery itself has no inputs or outputs. Keywords are:
<rtt>" XML tags are written, indicating the RTT from the syn-synack-ack exchange (if this could be calculated); the minimum RTT; the average RTT; and the maximum RTT. You can tell these apart by looking at the "
source" attribute. The actual RTT in seconds is stored in the "
value" attribute. For example: <rtt source='syn' value='0.083388' /> <rtt source='min' value='0.082697' /> <rtt source='avg' value='0.0932847' /> <rtt source='max' value='0.116549' />
<semirtt>" tags. Default is false. A semi-RTT is the length of time between the observation of a data packet, and the observation of the acknowledgement liberated by that data packet. The "
<semirtt>" tags are like the "
<rtt>" tags printed for the whole connection, but there may be an additional entry containing a bias-corrected sample variance for the semi-RTT measurements ("
source='var'"). For example: <semirtt source='syn' value='0.083183' /> <semirtt source='min' value='0.082529' /> <semirtt source='avg' value='0.089544' n='71' /> <semirtt source='max' value='0.1057' /> <semirtt source='var' value='2.07997e-05' n='71' />
<ackcausation>" tags. Default is false.
<undelivered>" tags. Default is false.
f :: FromDump(-, STOP true, FORCE_IP true) -> IPClassifier(tcp) -> af :: AggregateIPFlows -> tcol :: TCPCollector(-, SOURCE f, NOTIFIER af) -> TCPMystery(tcol, SEMIRTT true) -> Discard;