TCP-Reduce Documentation

Usage summary

Using the scripts is quite simple:
tcp-reduce file >reduced-file
reduces the tcpdump trace file file to the reduced form described below.
is an internal script you should not run directly.
tcp-summary reduced-file >summary-file
summarizes on a per-TCP-protocol basis a reduced file produced by tcp-reduce.

Format of the reduced files

Reduced files produced by tcp-reduce summarize each connection with a single ASCII line. This line contains 8 or 9 columns:
  1. timestamp when the connection began (first SYN packet)
  2. duration of the trace in seconds, or a ? if the trace did not show the connection terminating (no FIN or RST packets seen)
  3. protocol used by the connection. This in general is derived from the port number used by the responder to the initial SYN packet. An exception is made for an initial SYN packet sent from TCP port 20, which corresponds to the well-known port for ftp-data.
    Unidentified ports are reported as other-XXXX if non-privileged (> 1024) and priv-XXXX if privileged. If the unidentified traffic is coincident with an ftp connection between the two hosts, then it is reported as ftpdata-XXXX instead.
  4. bytes sent by originator of the connection, or ? if not available (due to connection not terminating, or terminating with RST).
  5. bytes sent by responder to the connection, or ? if not available.
  6. local host - the (possibly renumbered) local host that participated in the connection. See below for discussion of local and remote hosts.
  7. remote host - the (possibly renumbered) remote host that participated in the connection.
  8. state that the connection ended in. This can be one of the following: Note that connections ending in states S2 and S3 (or terminated by RST's after being in this state; e.g., RSTO3) may have byte counts associated with them. These connections were "half-closed". If the side that was half-closed was closed by a FIN packet, then the FIN packet provides an accurate byte count for the side that was closed, and a lower-bound byte count for the other side (from the sequence number ack'd by the FIN). Thus you may trust one of the byte counts, and the other is probably equal to or just a bit below the final byte count, though it could be much below if the connection persisted half-open for a long time.
  9. flags zero or more flags:

Configuring tcp-reduce

tcp-reduce has several configuration options:


Sometimes a packet gets mangled by the network, and while it still appears to be a SYN, FIN, or RST packet, its contents are obviously in error. This particularly occurs when a packet is truncated by the network. When tcp_conn encounters a mangled packet, it reports it as a bogon to stderr and discards it.

Output generated by tcp-summary

The output of tcp-summary consists of six columns (plus a header to remind you of what's in each column):
  1. TCP protocol
  2. Number of connections made or attempted using that protocol
  3. Number of kilobytes of user-level transferred in both directions
  4. Successful - percentage of connections that terminated in state SF, indicating normal SYN/FIN completion
  5. Local - percentage of connections initiated by local hosts
  6. Neighbor - percentage of connections in which the remote site was from a neighbor network.
The output is sorted on the third column (kilobytes). priv-XXXX, other-XXXX, and ftpdata-XXXX connections are lumped together as three collective protocols.

Protocols for which fewer than insig_bytes were transferred, or insig_conn connections were made, will not be reported. These variables are defined at the beginning of the script, and default to 500 KB and 100 connections, respectively.


The scripts were written by Vern Paxson ( and are copyrighted by the U.C. Regents as explained at the beginning of tcp_conn.