tcp retransmission checker

bash_tcp_retransmission_checker.sh

# the capture file should be filtered in order to contain 
# 1] the source address of the host for which we are checking the re-transmission mechanism for
# 2] and the destination should be any number of target hosts we are interested in
# 3] we only need the retransmitted packets (apply appropriate filter)
# 4] the capture file to be processed should be exported in text format with as much verbose info as possible

# script 1
# splits the capture in separate files (using a specific prefix) each containing a separate re-transmission stream - identified by the same destination IP and the same TCP sequence port

#!/bin/bash

if [ $# != 2 ]; then
  printf "usage: %s: capture_file output_file_prefix\n" $0
  echo $@

  exit 1
fi

CAPFILE=$1
PREFIX=$2

for target_host in `awk '{ print $4 }' $CAPFILE | sort | uniq`;
do
  grep ${target_host} $CAPFILE > $PREFIX"_"$terminal
done

for splitfile in `ls $PREFIX"_"*`; 
do 
  sequences=""
  sequences=`awk '{ for(i=1;i<NF;i++) if($i ~ /Seq/) print $i }' $splitfile | sort | uniq | strings`;
  echo $sequences
  
  for seq in $sequences;
  do
    grep "$seq " $splitfile | sort -nk1 > $splitfile"_"$((seq))
  done
done


# script 2
# it prints the re-transmission times between packets for a specific re-transmission stream contained in a single file

#!/bin/bash

INPUTFILE=$1

if [ $# != 1 ]; then
  printf "usage: %s: output_file_prefix\n" $0
  echo $@

  exit 1
fi

awk 'BEGIN{ prev=0 } { if(NR!=1) print $2-prev; prev=$2; }' $INPUTFILE