117680SpstBEGIN { 217680Spst # we need the number of bytes in a packet to do the output 317680Spst # in packet numbers rather than byte numbers. 417680Spst if (packetsize <= 0) 517680Spst packetsize = 512 617680Spst expectNext = 1 717680Spst lastwin = -1 817680Spst } 917680Spst { 1017680Spst # convert tcp trace to send/ack form. 1117680Spst n = split ($1,t,":") 1217680Spst tim = t[1]*3600 + t[2]*60 + t[3] 1317680Spst if (NR <= 1) { 1417680Spst tzero = tim 1517680Spst ltim = tim 1617680Spst OFS = "\t" 1717680Spst } 1817680Spst if ($6 != "ack") { 1917680Spst # we have a data packet record: 2017680Spst # ignore guys with syn, fin or reset 'cause we 2117680Spst # can't handle their sequence numbers. Try to 2217680Spst # detect and add a flag character for 'anomalies': 2317680Spst # * -> re-sent packet 2417680Spst # - -> packet after hole (missing packet(s)) 2517680Spst # # -> odd size packet 2617680Spst if ($5 !~ /[SFR]/) { 2717680Spst i = index($6,":") 2817680Spst j = index($6,"(") 2917680Spst strtSeq = substr($6,1,i-1) 3017680Spst endSeq = substr($6,i+1,j-i-1) 3117680Spst len = endSeq - strtSeq 3217680Spst id = endSeq 3317680Spst if (! timeOf[id]) 3417680Spst timeOf[id] = tim 3517680Spst if (endSeq - expectNext < 0) 3617680Spst flag = "*" 3717680Spst else { 3817680Spst if (strtSeq - expectNext > 0) 3917680Spst flag = "-" 4017680Spst else if (len != packetsize) 4117680Spst flag = "#" 4217680Spst else 4317680Spst flag = " " 4417680Spst expectNext = endSeq 4517680Spst } 4617680Spst printf "%7.2f\t%7.2f\t%s send %s %d", tim-tzero, tim-ltim,\ 4717680Spst flag, $5, strtSeq 4817680Spst if (++timesSent[id] > 1) 4917680Spst printf " (%.2f) [%d]", tim - timeOf[id], timesSent[id] 5017680Spst if (len != packetsize) 5117680Spst printf " <%d>", len 5217680Spst } 5317680Spst } else { 5417680Spst id = $7 5517680Spst 5617680Spst printf "%7.2f\t%7.2f\t%s ack %s %d", tim-tzero, tim-ltim,\ 5717680Spst flag, $5, id 5817680Spst if ($9 != lastwin) { 5917680Spst printf " win %d", $9 6017680Spst lastwin = $9 6117680Spst } 6217680Spst printf " (%.2f)", tim - timeOf[id] 6317680Spst if (++timesAcked[id] > 1) 6417680Spst printf " [%d]", timesAcked[id] 6517680Spst } 6617680Spst printf "\n" 6717680Spst ltim = tim 6817680Spst } 69