
TCP Toolbox v0.4

Mark Allman (mallman@icir.org)
ICSI Center for Internet Research

April 2007


This is a library for crunching libpcap trace files and collecting the
packets together into TCP connections for easy analysis as a single 
unit.  The library provides lots of handy features that I got tired
of doing for every analysis task I conducted (e.g., byte ordering, 
finding a pointer to the TCP header, parsing options, etc.).

A few notes:

  + I understand that there is no documentation.  I have literally been
    trying for years to produce some.  I have finally given up and just
    put this out.  If someone wants to document that'd be a great 
    service for which I would pay many beers.

  + There is a sample tool called "tcpsum" in the tools directory that
    produces simple connection summaries from a trace file.  You should
    be able to use it to get started.

  + A second example tool is "tcptsg" (also in tools) that was written
    by Ethan Blanton.  The tool produces TCP time-sequence plots that 
    can be displayed with xplot.

  + This has worked on the variety of unix variants I have used over the
    years.  If you need to patch it to make it work in your environment,
    please send the patches.

Acknowledgment: Ethan Blanton helped stress test and improve this library
while using it to do some TCP burstiness analysis many moons ago.

