Message-ID: <3A806AF8.66E3D414@cs.waikato.ac.nz> Date: Wed, 07 Feb 2001 10:22:00 +1300 From: Stephen Donnelly <sfd@cs.waikato.ac.nz> Subject: Re: An "IP Level Version" of TCPTrace, IPTrace if you will :-)
"Ivanovich, Milosh" wrote:
>
> Hi,
>
> I was wondering if someone can help me with the following query.
>
> * I would like to find a freeware software tool, which allows the user to
> postprocess TCPdump output files, so as to correlate packet pairs and
> calculate delay distributions (pdf's) at the IP level. That is, some kind of
> script which when told to filter for each IP-level packet pair (SrcA, DestB)
> . and (SrcC, DestD), will go on and calculate the statistical distribution
> of the timestamp differences between all the packet pair instances.
> Typically this is indeded for our applications where we want to measure the
> IP packet latencies across certain ethernet-connected devices.
It should be fairly simple to write a short C program to do what you
want. The libpcap library deals with reading tcpdump files, you could
simply open both files, and compare IP Src and Dst addresses plus Id
fields of packets to find matches.
A brief word of warning however, if the device delays you are going to
measure are small, that is less then a millisecond, or a few
milliseconds, then you may be disappointed by the accuracy available
with tcpdump and conventional NIC cards. NIC behaviour, and Linux or BSD
OS behaviour tend to reduce accuracy to only 100 microseconds or so.
(This may be fine for your application of course).
Stephen.
--
-----------------------------------------------------------------------
Stephen Donnelly (BCMS) email: sfd@cs.waikato.ac.nz
WAND Group Room GG.15 phone +64 7 838 4086
Computer Science Department, University of Waikato, New Zealand
-----------------------------------------------------------------------
----------------------------------------------------------------------------
To unsubscribe, send a message with body containing "unsubscribe tcptrace" to
majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 02/07/01 EST