<tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [flow &lt;type,srcAddr/port,dstAddr/port&gt;,flowId]</tt>         <br>        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [exclude &lt;type,srcAddr/port,dstAddr/port&gt;,flowId]</tt>         <br>        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [input &lt;inputFile&gt;]    [output &lt;outputFile&gt;</tt><tt>]<br>         &nbsp; &nbsp; &nbsp; &nbsp; </tt><tt>[link &lt;src&gt;[,&lt;dst&gt;]][send    | recv]<br>         &nbsp; &nbsp; &nbsp; &nbsp; </tt><tt>[range [&lt;startSec&gt;][:&lt;stopSec&gt;]][offset    &lt;hh:mm:ss&gt;]<br>        &nbsp; &nbsp; &nbsp; &nbsp; [summary][histogram][replay &lt;factor&gt;]</tt>         <br>        <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [png &lt;pngFile&gt;][post     &lt;postFile&gt;][multiplot][ramp][alimit &lt;bytes&gt;]</tt> <br>        &nbsp; </p>               <p>&nbsp;NOTE:&nbsp;&nbsp;&nbsp; T<i>ype, addr, or port parameters can be    "wildcarded" with an 'X' character.</i> <br>        &nbsp; </p>               <h3> Command Line Parameters and Options:</h3>         &nbsp;         <table width="100%" nosave="">         <tbody>            <tr nosave="">         <td valign="top" width="30%" nosave="">version</td>          <td>Causes <i>trpr</i> to display program version number and exit.</td>         </tr>          <tr>         <td>drec</td>          <td><i>trpr</i> will expect to process a <i>drec</i> log file instead    of        <i>tcpdump</i> hex output.</td>         </tr>          <tr>              <td valign="top">ns<br>              </td>              <td valign="top"><i>trpr</i> will expect to process a <i>ns</i>     trace  file instead of <i>tcpdump</i> hex output.<br>              </td>            </tr>            <tr nosave="">         <td valign="top" nosave="">raw</td>          <td>When this option is given, the &lt;outputFile&gt; will only include    unlabeled sets of plotting data without the default <i>gnuplot</i>  compatible    headers.&nbsp; This is useful to get the "raw" plot data for importing into   a spreadsheet or other plotting program.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">key</td>          <td>With this option, trpr will print a "key" to the data plotsets   in  the &lt;outputFile&gt;.&nbsp; This consists of one comma-delimited line   with  a leading "#" character.&nbsp; This line is printed when new flows  of data  are detected and another data set column is output.&nbsp; The first   column  is marked "Time".&nbsp; Subsequent columns are labeled with a description    of the flow data being plotted.</td>         </tr>          <tr>         <td valign="top">rate<br>         </td>         <td valign="top">Causes <i>trpr</i> to create plots of data rate versus  time. &nbsp;The <u>window</u>     command  can be used to set <i> trpr</i>  's rate averaging window.&nbsp;  The <u>rate </u>command is the implicit  default plot mode for <i>trpr.</i><br>         </td>       </tr>       <tr nosave="">         <td valign="top" nosave="">interarrival</td>          <td>Causes <i>trpr</i> to create plots of differential interarrival   packet   delays for detected flows instead of the default data rate versus   time plot.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">latency</td>          <td>Causes <i>trpr</i> to create plots of transmission delay for       <i>   drec</i>    flows instead of the default data rate versus time plot.&nbsp;  This type   of plot is only available for <i>drec</i> operation.</td>         </tr>          <tr>         <td>loss</td>          <td>Causes <i>trpr</i> to create plots of packet loss based onreceived  sequence numbers for <i>drec</i>    flows  instead of the defaultdata rate  versus time plot.&nbsp; This type   of plot  is only availablefor <i>drec</i>    operation.&nbsp; The <u>window</u>     command  can beused to set <i> trpr</i>  's loss averaging window.&nbsp;  The "window" specified should be large  enough to encompass several expected   packetevents  for desired results.</td>         </tr>          <tr>         <td valign="top">count<br>         </td>         <td valign="top">Causes <i>trpr</i> to create plots of packet counts  versus time instead of the default data rate versus time plot. &nbsp;The       <u>window</u>     command  can be used to set <i>trpr</i>'s count accumulation  window.&nbsp;  The <u>rate </u>command is the implicit default plot mode for       <i>trpr.</i><br>         </td>       </tr>       <tr nosave="">         <td valign="top" nosave="">real</td>          <td>When this option is given, <i>trpr</i> will output plotting commands     and data to its <tt>stdout</tt>.&nbsp; This output is intended for the        <tt>   stdin</tt> of gnuplot for real-time plotting.&nbsp; However,  note that this  output can be redirected to a file for storage, and then later that file can be directed to the input of <i>gnuplot</i> for "playback".&nbsp;   Note that the "real-time" mode can be used simultaneously with <i>trpr</i>     's cumulative  "non-real-time" <u>output</u> option.&nbsp; Note that the   "real time" graph&nbsp;  update occurs once per <u>window</u>  time.&nbsp;   This option can also be used with pre-existing trace files.&nbsp; Use the   replay command to limit the actual graph animation rate or the tracefile   will be parsed at "cartoon rate" (i.e. as fast as possible).</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">gif &lt;gifFile&gt;</td>          <td>This option commands <i>gnuplot</i> to create a "gif" (Graphics   Interchange   Format) file when it plots instead of the default X11 display.&nbsp;   The  &lt;gifFile&gt; parameter is the name of the file <i>gnuplot</i> will   create  when it processes       <i>trpr</i>'s output.&nbsp; This can be used  in either  real-time or non-real-time operation.&nbsp; In real-time operation,  the &lt;gifFile&gt;  will be periodically overwritten according to <u>window</u>    setting.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">post &lt;postFile&gt;</td>          <td>This option commands <i>gnuplot</i> to create a Postscriptfile   when   it plots instead of the default X11 display.&nbsp; The &lt;postFile&gt;   parameter  is the name of the file <i>gnuplot</i> will create when it processes         <i>trpr</i> 's output.&nbsp; This can be used in either real-time or  non-real-time operation.&nbsp;  In real-time operation, the &lt;postFile&gt;   will be periodically overwritten  according to <u>window</u> setting.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">multiplot</td>          <td valign="top" nosave="">With <i>gnuplot</i>, <i>trpr</i> will create    a "multiplot" graph with one graph per detected flow (stackedvertically).     (This only works with the real-time upated (<u>real</u>command) graphing     mode for now).</td>         </tr>          <tr>          <td valign="top">ramp<br>          </td>          <td valign="top">By default, <i>trpr </i>creates "stair step" plots  of its averaging <u>window</u> results (i.e. 2 data &nbsp;points per window).  &nbsp;The optional <u>ramp </u>command causes <i>trpr </i>to create plots  with one data point per averaging window (at the window's end), thus "ramping"  from one window to the next. &nbsp;This may be useful for alternative post-processing  of <i>trpr</i>'s output files or to reduce the number of data points onplots  with an extremely large number of data points where the <u>window</u> start/stop  points are indiscernable anyway.<br>          </td>        </tr>             <tr nosave="">         <td valign="top" nosave="">window &lt;sec&gt;</td>          <td>This parameter sets the step size of <i>trpr</i>'s window-based   data   rate and packet loss averaging algorithms.&nbsp; The step size unit   is time  in seconds.&nbsp; This algorithm counts the cumulative quantity  of data (or  packet loss) in each window of time and calculates the kilobits-per-second     (kbps)&nbsp; (or loss fraction) value for each step.&nbsp; These discrete     values of data rate (or loss fraction) versus time comprise <i>trpr</i>     's   plot data.&nbsp; Two points are plotted, one at each time window's  beginning   and one at its end, to form a "stair step" plot.&nbsp; The      <u>    window</u>    command also controls the <i>gnuplot</i> real-timegraph  update  rate for&nbsp;        <u> real</u> command operation.&nbsp;The <u>  window</u>   &lt;sec&gt;  value can  be specified as "-1" to cause      <i>trpr</i>   to average  across the  entire trace file (or the periodspecified by the        <u>range</u>   command).&nbsp;  Note the negative      <u>window</u> value  should <b>not</b>   be used in combination  withthe <u>real</u> command.        <br>        Default = 1 second.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">history &lt;sec&gt;</td>          <td>This parameter determines the range (in time units of seconds)  of  the  X-axis of the graphs produced in <i>trpr</i>'s real-time mode.&nbsp;    As time progresses, the <i>gnuplot</i> graphs will scroll in "strip-chart"    fashion to display the current <u>history</u> of network activity. <br>        Default = 20 seconds.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">auto &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>          <td>This command instructs <i>trpr</i> to automatically discover and   plot  "flows" of network data according to the matching (type,src,dst,id)  criteria   provided.&nbsp; Otherwise, <i>trpr</i> only plots "flows" given  by the       <u>   flow</u> option described below.&nbsp; Valid valuesfor   &lt;type&gt; include  "X", "udp", "tcp", or the numeric value of theIP protocol  type of interest.&nbsp;   The "X" value "wildcards" the &lt;type&gt;so that        <i> trpr</i> will automatically   create a plot on the graphfor any  type of IP protocol which meets the given  &lt;source,destination&gt; criteria.&nbsp;  The source and destination addresses  (srcAddr &amp;dstAddr) must be given  in dotted decimal notation or may also  be wildcardedwith an "X" character.&nbsp;  The &lt;source,destination&gt;   portion mayalso be omitted and then will  be automatically wildcarded.&nbsp; The optional "id" portion of the flow description corresponds to any "flow id" whichmay  apply to the data analyzed. &nbsp;This currently only applies to <u>drec      </u>log files when the user wishes to additionally differentiate <u>  drec</u> flows by their "flow id". &nbsp;(See the <i>mgen       </i>user's guide for more information). &nbsp;As an example,   "<tt> auto udp</tt>"will cause <i>trpr</i>  to enumerate individual plots  for each unique UDPprotocol flow detected regardless of source or destination.&nbsp;   The sourceand destination port numbers can be explicitly specified or wildcarded  withan "X" or implicitly through omission.&nbsp; Note that flows which match those given with the       <u>flow</u> option (see below)&nbsp; will notbe tested  against the       <u>auto</u> criteria.&nbsp; The <u> auto</u> option may be used  multiple times on the <i>trpr</i> command line to establishmultple sets of automatic flow matchiing criteria (e.g.       <tt>trpr autoudp auto tcp ...</tt>  ").</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">flow &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>          <td>This command instructs <i>trpr</i> to look for and plot specific   "flows"  which match the given (type,src,dst) criteria.&nbsp; All flows which  match  the given criteria are accumulated together onto a singleplot  line.&nbsp;   The address and port criteria are given in the same wayas for the <u>auto</u>      command and may be wildcarded in the same way.&nbsp; For example, the  option  "<tt>flow udp</tt>" will cause <i>trpr</i> toaccumulate  all detected  UDP  traffic (regardless of source and destinationsince they  are implicitly  wildcarded here) into a single plot.&nbsp; Thusthe command  "<tt>trpr flow  udp flow tcp ...</tt>" will produce a graphwith two lines,  one plotting cumulative UDP traffic and the other plottingcumulative TCP  traffic detected by <i>  tcpdump</i>.&nbsp; As with the <u>auto</u>option,  the <u>flow</u>    option may be used multiple times on the commandline and may be used in conjunction with the <u>auto</u> option.&nbsp; Flowsof network traffic matching the criteria specified with the <u>flow</u> option