Printing TCP Options?

Carter Bullard carter at qosient.com
Fri Oct 7 16:14:26 EDT 2011


Hey Nikki,
I do understand.  We have the actual window scale value that was used, as we use it when calculating the " swin " and " dwin " values, so not sure that that specific option is a problem.
The most important ones, for me, are the CC and CC.NEW options, as they are needed to figure out what is going on when you don't see the Syn/SynAck/Ack volley.  That way you could see that they are using Transactional TCP.   We don't capture the CC values in this current version of Argus.

OK, well this is in argus-clients-3.0.5.21, which I've just now put up on the server.
If you find any problems with the " tcpopt " option, holler !!!!

Carter


On Oct 7, 2011, at 3:55 PM, Nichole K. Boscia wrote:

> 
> Hi Carter,
> 
> Yes, this is exactly what I am looking for -- negotiated TCP options. Most of the options are okay as you define them below, except for something like winscale, which will have an integer value associated with it.  It's still better than what we have now though, so I am excited to see this update from you!
> 
> Thanks,
> -Nikki
> 
> -------------------------------------------
> Nichole K. Boscia
> Senior Network Engineer, CSC
> NASA Advanced Supercomputing Division
> Ames Research Center, Moffett Field, CA 94035
> 
> On Fri, 7 Oct 2011, Carter Bullard wrote:
> 
>> Date: Fri, 7 Oct 2011 12:25:47 -0500
>> From: Carter Bullard <carter at qosient.com>
>> To: "Boscia, Nichole K. (ARC-TN)[Computer Sciences Corporation]"
>>    <nichole.boscia at nasa.gov>
>> Cc: Argus <argus-info at lists.andrew.cmu.edu>
>> Subject: Re: [ARGUS] Printing TCP Options?
>> Hey Nikki,
>> Since I hadn't shifted the "tcpopt" field into argus-clients-3.x, we can specify its output now if you don't like what is now there.
>> Currently, it is implemented like the "flgs" field, a fixed length string with single characters used to indicate the state for a particular value.
>> 
>> We have 12 TCP options that we need to convey from our TCP options bitmap, so the field is 12 characters long, with spaces used for placement.  A unique character is used to specify that a specific option is on.  Here is the current format:
>> 
>> ARGUS_TCP_MAXSEG:    option[0]  = 'M'
>> ARGUS_TCP_WSCALE:    option[1]  = 'w'
>> ARGUS_TCP_SACKOK:    option[2]  = 's'
>> ARGUS_TCP_SACK:      option[3]  = 'S'
>> ARGUS_TCP_ECHO:      option[4]  = 'e'
>> ARGUS_TCP_ECHOREPLY: option[5]  = 'E'
>> ARGUS_TCP_TIMESTAMP: option[6]  = 'T'
>> ARGUS_TCP_CC:        option[7]  = 'c'
>> ARGUS_TCP_CCNEW:     option[8]  = 'N'
>> ARGUS_TCP_CCECHO:    option[9]  = 'O'
>> ARGUS_TCP_SRC_ECN:   option[10] = 'S'
>> ARGUS_TCP_DST_ECN:   option[11] = 'D'
>> 
>> And here is how it looks with the various ra.1 printing options, space filled, character delimited, and XML:
>> 
>> ../bin/ra -r /tmp/argus.out -s stime dur proto tcpopt
>>                StartTime        Dur  Proto       TcpOpt
>> 2011/10/03.11:03:27.407610   4.820016    tcp Mws   T
>> 2011/10/03.11:03:32.657344   4.855263    tcp Mws   T
>> 2011/10/03.11:03:34.899137   0.000719    udp
>> 2011/10/03.11:03:34.900225   0.106366    tcp Mws   T
>> 2011/10/03.11:03:35.002305   0.984422    udp
>> 2011/10/03.11:03:35.002495   1.107643    udp
>> 2011/10/03.11:03:35.002775   0.078968    udp
>> 2011/10/03.11:03:35.003062   0.111157    udp
>> 2011/10/03.11:03:35.003292   0.000000    arp
>> 2011/10/03.11:03:36.004261   0.062153    udp
>> 
>> 
>> ../bin/ra -r /tmp/argus.out -s stime dur proto tcpopt -c ,
>> StartTime,Dur,Proto,TcpOpt
>> 2011/10/03.11:03:27.407610,4.820016,tcp,Mws   T
>> 2011/10/03.11:03:32.657344,4.855263,tcp,Mws   T
>> 2011/10/03.11:03:34.899137,0.000719,udp,
>> 2011/10/03.11:03:34.900225,0.106366,tcp,Mws   T
>> 2011/10/03.11:03:35.002305,0.984422,udp,
>> 2011/10/03.11:03:35.002495,1.107643,udp,
>> 2011/10/03.11:03:35.002775,0.078968,udp,
>> 2011/10/03.11:03:35.003062,0.111157,udp,
>> 2011/10/03.11:03:35.003292,0.000000,arp,
>> 2011/10/03.11:03:36.004261,0.062153,udp,
>> 
>> 
>> ../bin/ra -r /tmp/argus.out -s stime dur proto tcpopt -M xml
>> <?xml version ="1.0" encoding="UTF-8"?>
>> <!--Generated by ra(3.0.5.20) QoSient, LLC-->
>> <ArgusDataStream
>> xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance"
>> xsi:noNamespaceSchemaLocation = "http://qosient.com/argus/Xml/ArgusRecord.3.0.xsd"
>> BeginDate = "2011-09-16T11:52:47.355095" CurrentDate = "2011-10-07T13:09:21.721079"
>> MajorVersion = "3" MinorVersion = "0.3" InterfaceType = "DLT_NULL" InterfaceStatus = "Up"
>> ArgusSourceId = "192.168.0.68"  NetAddr = "0.0.0.0"  NetMask = "0.0.0.0">
>> 
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:27.407610" Duration = "4.820016" Proto = "tcp" TcpOptions = "Mws   T     "></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:32.657344" Duration = "4.855263" Proto = "tcp" TcpOptions = "Mws   T     "></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:34.899137" Duration = "0.000719" Proto = "udp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:34.900225" Duration = "0.106366" Proto = "tcp" TcpOptions = "Mws   T     "></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:35.002305" Duration = "0.984422" Proto = "udp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:35.002495" Duration = "1.107643" Proto = "udp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:35.002775" Duration = "0.078968" Proto = "udp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:35.003062" Duration = "0.111157" Proto = "udp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:35.003292" Duration = "0.000000" Proto = "arp"></ArgusFlowRecord>
>> <ArgusFlowRecord  StartTime = "2011-10-03T11:03:36.004261" Duration = "0.062153" Proto = "udp"></ArgusFlowRecord>
>> </ArgusDataStream>
>> 
>> If you have another way that would work, please holler.  If OK, I'll upload the new clients with this support sometime this weekend.
>> Carter
>> 
>> On Oct 7, 2011, at 12:06 PM, Carter Bullard wrote:
>> 
>>> Hey Nikki,
>>> Argus does not capture TCP headers, so we don't have TCP header content, per se.
>>> We do capture much of the TCP session semantics, so things like negotiated TCP options,
>>> TCP state progression, etc…., some sequence numbers, etc…. are available.
>>> 
>>> But now that I'm looking at the client source, the "tcpopt" and "tcpext" field, didn't make
>>> the 3.0 cut.  I'll have to put it back in.
>>> 
>>> So what in particular are you looking for?  Just the negotiated options at setup?
>>> 
>>> Carter
>>> 
>>> On Oct 5, 2011, at 10:05 PM, Nichole K. Boscia wrote:
>>> 
>>>> 
>>>> Hi folks,
>>>> 
>>>> I need to pull TCP options such as selective ack, timestamps, winscale, etc. for captured flows.  I assume this is captured since it's part of the TCP header, but I'm not seeing how to print out the values with ra tools.
>>>> 
>>>> Thanks,
>>>> -nikki
>>>> 
>>>> -------------------------------------------
>>>> Nichole K. Boscia
>>>> Senior Network Engineer, CSC
>>>> NASA Advanced Supercomputing Division
>>>> Ames Research Center, Moffett Field, CA 94035
>>>> 
>>> 
>> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4367 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20111007/f5ae9af2/attachment.bin>


More information about the argus mailing list