STREAM

Purpose

Sometimes messages span multiple packets. TELNET and DNS are examples. The STREAM report (with the DUMP or FORMAT keywords) captures the entire stream of data.

Format

CTRACE COMP(SYSTCPDA) SUB((TCPCS)) SHORT OPTIONS((STREAM DUMP ASCII))

===============================================================================
 1  Streams Report
    60 Streams found
 23600 bytes of storage for the session report was allocated
1146880 bytes of storage for buffers was allocated

-------------------------------------------------------------------------------
 2  Session: FEC9:C2D4::206:2AFF:FE71:4400-0 FEC9:C2D4::6:2900:EDC:217C-0 ICMPv6
 From: 2002/02/12 19:55:04.615118 to: 2002/02/12 19:55:09.636234
      3 packets found
 Stream buffer at 0A818000 for 20480 bytes. 144 bytes were used
      3 packets moved for 144 bytes
I - Inbound packet
O - Outbound packet

 3  D Rcd #            Time           Delta      Seq #   Position Length    End_Pos
I    90 19:55:04.615118 00:00:00.000000          0          0     24         24
000000 FEC9C2D4 00000000 02062AFF FE714400  02010006 2A714400                   |..........*..qD.....*qD.        |
I    91 19:55:04.631206 00:00:00.016087         24         24     60         84
000000                                                        60000000 00141101 |                        `.......|
000020 FEC9C2D4 00000000 00062900 0EDC217C  FEC9C2D4 00000000 02062AFF FE714400 |..........)...!|..........*..qD.|
000040 802A829B 0014A3B6 01010000 3C697318  00095CAB                            |.*..........<is.....

1

After all the records have processed, the number of streams and the amount of storage required for the report and buffers are shown.

2

Each session is identified by the IP addresses, port number, and protocol. The time stamps of the first and last packet are shown along with the number of packets, the address, and size of the stream buffer.

3

When a stream is dumped, each packet and the data from the packet is shown. If there are gaps in the stream, the number of bytes skipped is displayed. The data about each packet formatted are:

D: The direction of the packet: I for inbound and O for outbound.
Rcd #: The record number.
Time: The time stamp of the record.
Delta: The time from the first record of the stream.
Seq #: The sequence number of the TCP packet. For other packets it is the relative offset of the packet from the first packet.
Position: The relative offset of the packet.
Length: The number of bytes in the packet.
End_Pos: The ending sequence number.