will be accumulated into a matching flow plot and are also tested againstthe sets of <u>auto</u>  option criteria so redundant plot lines may resultdepending on the criteria used.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">exclude &lt;type,srcAddr:port,dstAddr:port,id&gt;</td>          <td valign="top" nosave="">This command instructs <i>trpr</i> to ignore    specific "flows" which match the given (type,src,dst) criteria.&nbsp; The    address and port criteria are given in the same way as for the <u>  auto</u>       command and may be wildcarded in the same way.&nbsp; For example,the   option  "<tt>flow udp</tt>" will cause <i>trpr</i> to ignore all detected  UDP traffic  (regardless of source and destination since they are implicitly  wildcarded  here).&nbsp; The <u>exclude</u> command filters are evaluated  before the       <u>auto</u> and <u>flow</u> command filters.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">input &lt;inputFile&gt;</td>          <td>This option instructs <i>trpr</i> to use the file name given by  &lt;inputFile&gt;   for input.&nbsp; Otherwise <i>trpr</i> looks forinput  from <tt>stdin</tt>   .&nbsp; The expected input format is&nbsp; textoutput  from the <i>tcpdump</i>    program run with its hexadecimal option(-x) given  and properly filtered   so that only IP protocol data is captured.&nbsp;  Non-IP data from <i>tcpdump</i>    will result in errors in <i>trpr</i>'s  output.</td>         </tr>          <tr nosave="">         <td valign="top" nosave="">output &lt;outputFile&gt;</td>          <td>This option instructs <i>trpr</i> to save cumulative data into  the  file name given by &lt;outputFile&gt; for later (non-real-time) plotting.&nbsp;     The plot data stored here contains data from the entire <i>tcpdump</i>    run  (as opposed to the <i>trpr</i> real-time mode's limited <u>history</u>     of  data).&nbsp; By default (i.e. unless the <u>raw</u> option is given),   the  output file contains text header information at its beginning so that         <u>   gnuplot</u> can be used to create a nicely-labelled graph.&nbsp;</td>         </tr>          <tr>              <td valign="top">link &lt;src&gt;[,&lt;dst&gt;]<br>              </td>              <td valign="top">This causes <i>trpr </i>to process only packets   associated  with the identified "link" or "node". &nbsp;For <i>ns </i>trace   files, the  &lt;src&gt; and &lt;dst&gt; values correspond to simulation node  identifiers.  &nbsp;For <i>tcpdump </i>operation, the MAC addressis  used.  &nbsp;Note that  &lt;src&gt; and/or &lt;dst&gt; values can bewildcarded   by omission or by  designating 'X' as the value. &nbsp;For <i>n</i>ssimulations    &nbsp;using  the wireless/mobility extensions, the &lt;dst&gt;value may   be "AGT" or "RTR"  corresponding to the wireless transmissiontype (By default,    both "AGT" and"RTR"  are counted by <i>trpr) </i>sincethe notion of "links"    is not used in the  trace files. &nbsp;Wildcardingthe &lt;src&gt; or &lt;dst&gt;    values allows  the user to analyze alltraffic arriving to and/or leaving    from a specific  simulation node orMAC address. &nbsp;The <u>send</u> and         <u>recv</u> commands  maybe optionally used in combination with the         <u>link</u> command tospecify  whether only arriving packets (<u>   recv</u>  ) or departing packets(<u>send</u>  ) are processed. &nbsp;By   default, both arriving and departingpackets are  processed.<br>              </td>            </tr>            <tr>              <td valign="top">send<br>              </td>              <td valign="top">Specifies that only "sent" packets are tobe  processed.   &nbsp;In <i>ns</i>, this corresponds to 's' events for traced  links or nodes.   &nbsp;In <i>tcpdump</i>, this corresponds to packets whose  source MAC address   correspond to the &lt;src&gt; value given with the      <u>  link</u>  command. &nbsp;By  default, both "sent" and "received" packets  are counted by <i>trpr</i> . &nbsp;The        <u>send</u> &nbsp;and       <u>recv</u>   commands are generally  useful only  for <i>ns </i>simulations but may be applicable to <i>tcpdump</i>   trace file  analysis in some situations.<br>              </td>            </tr>            <tr>              <td valign="top">recv<br>              </td>              <td valign="top">Specifies that only "received" packets are to  be  processed. &nbsp;In <i>ns</i>, this corresponds to 'r' events for traced   links or nodes. &nbsp;In <i>tcpdump</i>, this corresponds to packets whose   destination MAC address corresponds to the &lt;dst&gt; value given with the        <u> link</u> command. &nbsp;By default, both "sent" and "received"  packets are counted by <i>trpr</i> . &nbsp;The <u>send</u> &nbsp;and <u> recv</u>    commands are generally useful only for <i>ns </i>simulations butmay be  applicable  to <i>tcpdump</i> trace file analysis in some situations.<br>              </td>            </tr>            <tr nosave="">         <td valign="top" nosave="">range &lt;startSec&gt;[:stopSec]</td>          <td>Causes <i>trpr</i> to skip ahead to the "start time" (in seconds)    from  the first packet event in the trace file and end processing at the   optional  "stop time" (in seconds).&nbsp; Setting the "stop time" to -1 causes        <i>trpr</i>  to process until the end of the trace input. &nbsp;Note   the       <u>range </u> command may be used in combination with the <u> offset         </u> and/or <u>absolute       </u>commands to perform analysis for  a specific time period in the trace file.</td>         </tr>          <tr>              <td valign="top">offset &lt;hh:mm:ss&gt;<br>              </td>              <td valign="top">This allows the user to specify an absolute analysis    start time using a time-of-day reference. &nbsp;The time given is in 24-hour    clock time format and must be within 12 hours of the time of the first packet   event in the trace file.<br>              </td>            </tr>            <tr>              <td valign="top">absolute<br>              </td>              <td valign="top">Causes <i>trpr </i>to use the absolute time given    in the trace file in its output instead of "normalizing" the time values   (generally the plots' x-axis) to zero time for the first packetevent or  optional       <u> off</u>set time.<br>              </td>            </tr>            <tr>              <td valign="top">summary<br>              </td>              <td valign="top">This causes <i>trpr</i> to output summarystatistics     of results to <i>stdout</i> at the end of analysis. &nbsp;Thesesummary   results  are available with or without the production of data intendedfor   plotting.<br>              </td>            </tr>            <tr>              <td valign="top">histogram<br>              </td>              <td valign="top">This causes <i>trpr</i> to output a histogram  of  the values of analyses intervals (intervals determined by the window command)   for each flow to <i>stdout</i>. &nbsp;Some percentile information of the  histogram content is also provided in the output. &nbsp;The histograms are  comma-delimited tables of values. &nbsp;Currently the quantizationsize  and  curve of the histogram is fixed and adapts in range with data.&nbsp;The   histogram output may be useful for packet <u>latency</u> analyses.<br>              </td>            </tr>            <tr>         <td>replay &lt;factor&gt;</td>          <td>This limits <i>trpr</i>'s rate of real-time <i>gnuplot </i>graph   generation  to a &lt;factor&gt; of&nbsp; real time when parsing a pre-existing   trace file.&nbsp; When the <u>replay</u> command is given, <i>trpr</i>generates   the same gnuplot output as for the <u>real</u> command.&nbsp;The &lt;factor&gt;   parameter scales the playback rate with respect to realtime.&nbsp; For example,  &lt;factor&gt; = 1 is actual real time, while &lt;factor&gt;= 2 is double  speed playback.&nbsp; Note that real time update occurs once per <u>window</u>     time.</td>         </tr>                                   </tbody>        </table>          <br>        &nbsp;         <h3> <i>tcpdump</i> Hints:</h3>         1)&nbsp;&nbsp;&nbsp; Make sure you are using <i>tcpdump</i> filters  such   that only IP packets are captured (<i>trpr</i> currently doesn't<br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; like non-IP packets in <i>   tcpdump</i>    's output).         <p>2)&nbsp;&nbsp;&nbsp; Always use the "-x" option when using <i>tcpdump</i>         with <i>trpr</i>.&nbsp; (<i>trpr</i> looks for and parses the hexadecimal     output) </p>               <p>3)&nbsp;&nbsp;&nbsp; Use <i>tcpdump</i>'s "-n" option to skip DNS lookups     and speed up <i>tcpdump</i>'s performance (<i>trpr</i> only uses dotted   <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; decimal numeric IP addresses).     </p>               <p>4)&nbsp;&nbsp;&nbsp; Use <i>tcpdump</i>'s line buffering option ("<tt>        -l"</tt>)&nbsp; to get output with minimal delay for real time plotting.    </p>               <p>5)&nbsp;&nbsp;&nbsp; Read and learn <i>tcpdump</i>'s man page for the extensiveset of filtering options <i>tcpdump</i> provides.&nbsp; Uses these <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; filter options in conjunction    with  <i>trpr</i>'s own filters to get the graphical results you want. </p>               <p>6)&nbsp;&nbsp;&nbsp; Leverage <i>tcpdump</i>'s ability to store captured     data in a binary file (use tcpdump's "-w" option) and then <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; post-process it with <i>  tcpdump</i>      's filter's (using <i>tcpdump</i> to process the stored binary file with   its "<tt>-r</tt>" option <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; and redirecting its output&nbsp;     to <i>trpr</i>). <br>        &nbsp; </p>               <h3> <i>gnuplot</i> Hints:</h3>                  <p><br>        1)&nbsp;&nbsp;&nbsp; Use <i>gnuplot</i>'s "<tt>-noraise</tt>" option  when   using with <i>trpr</i> in "real-time" mode if you don't want theupdated   <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; plots to continually pop  to  your  display's top level. </p>               <p>2)&nbsp;&nbsp;&nbsp; Use <i>gnuplot</i>'s "<tt>-persist</tt>" option if    you wish the last plot to remain displayed after exiting. </p>               <p>3)&nbsp;&nbsp;&nbsp; <i>trpr</i>'s output files for <i>gnuplot</i> are     in text format and easily edited to customize output.&nbsp; <i>Gnuplot</i>         is a very flexible <br>        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; program with lots of options    to get the graphs into almost any format you would like.&nbsp; It is also    lightning fast. <br>        &nbsp; </p>               <h2> Examples of Use:</h2>         (TBD) <br>        &nbsp;         <h2> Credits:</h2>         <i>trpr</i> was written by:         <p>Brian Adamson <br>        <a href="mailto://adamson@itd.nrl.navy.mil">adamson@itd.nrl.navy.mil</a>         </p>               <p>Your questions and comments are welcome and appreciated. (30 July 2002)     <br>        &nbsp; <br>        &nbsp; </p>               <br></body></html>