.\"
.\" sc_analysis_dump.1
.\"
.\" Author: Matthew Luckie <mjl@luckie.org.nz>
.\"
.\" Copyright (C) 2010      University of Waikato
.\" Copyright (C) 2013-2014 The Regents of the University of California
.\"                         All rights reserved
.\"
.\" $Id: sc_analysis_dump.1,v 1.10 2017/02/17 22:05:13 mjl Exp $
.\"
.\"  nroff -man sc_analysis_dump.1
.\"  groff -man -Tascii sc_analysis_dump.1 | man2html -title sc_analysis_dump.1
.\"
.Dd February 18, 2017
.Dt SC_ANALYSIS_DUMP 1
.Os
.Sh NAME
.Nm sc_analysis_dump
.Nd dump of traceroute data in a format that is easily parsed.
.Sh SYNOPSIS
.Nm
.Bk -words
.Op Fl cCdeghHilMopQrstT
.Op Fl D Ar debug-count
.Op Fl G Ar geo-server
.Op Fl S Ar skip-count
.Op Ar
.Sh DESCRIPTION
The
.Nm
utility provides a dump of traceroute data in a format that is easily
parsed by scripts.
Each line output contains a summary of a single trace, and includes the
interfaces visited and the delay of each response.
The output format is identical to that of sk_analysis_dump from CAIDA,
except that it uses the scamper file API to read both arts++ files
produced by skitter and warts files produced by scamper.
The
.Nm
utility only outputs traceroute data; for parsing other types of
measurement, use
.Xr sc_warts2json 1
instead.
The options are as follows:
.Bl -tag -width Ds
.It Fl c
disables printing the cycle number in each line of output.
.It Fl C
disables printing the comments about the output at the top of the output.
.It Fl d
disables printing the destination address in each line of output.
.It Fl D Ar debug-count
for each input file stop reading after the specified number of traces.
.It Fl e
adds the response from the destination to each line of output.  Please
read the bugs section below.
.It Fl g
use geographical data from netacuity.
Not all builds of
.Nm
support this option.
.It Fl G Ar geo-server
specifies the name of the netacuity server to use.
.It Fl h
prints a help message and then exits.
.It Fl H
disables printing the halt fields: why traceroute halted and data for that
reason.
.It Fl i
disables printing the RTT to each hop, and how many tries were required.
.It Fl l
disables printing the list id in each line of output.
.It Fl M
prints any MPLS label stack objects embedded in ICMP responses.
.It Fl o
prints each line of output using the old format from sk_analysis_dump 1.0.
.It Fl p
disables print path data in each line of output.
.It Fl Q
prints the IP-TTL from inside the ICMP quotation.
.It Fl r
disables printing the data associated the response from a destination:
the RTT, the TTL of the probe, and the TTL of the response.
.It Fl s
disables printing the source IP address in each line of output.
.It Fl S Ar skip-count
skips the defined number of traces from each input file.
.It Fl t
disables printing the timestamp of when the traceroute began.
.It Fl T
prints the IP-TTL of the response packet.
.El
.Sh OUTPUT
There is one trace per line.
Fields are separated by a tab character.
The output is structured into header fields (2 to 6), reply fields (7 to 10)
corresponding to the response received from the destination, halt fields
(11 and 12), and hop fields (beginning at index 13).
.Bl -enum -width 2n -offset indent
.It
.Tn "Key"
.Pp
Indicates the type of line and determines the meaning of the remaining fields.
This will always be 'T' for an IP trace.
.It
.Tn "Source"
.Pp
Source IP of skitter/scamper monitor performing the trace.
.It
.Tn "Destination"
.Pp
Destination IP being traced.
.It
.Tn "ListId"
.Pp
ID of the destination list containing this destination address.
This value will be zero if no list ID was provided.
A ListId is a 32 bit unsigned integer.
.It
.Tn "CycleId"
.Pp
ID of current probing cycle.
A cycle is a single run through a given list.
A CycleId is a 32 bit unsigned integer.
For skitter traces, cycle IDs will be equal to or slightly earlier than the
timestamp of the first trace in each cycle. There is no standard
interpretation for scamper cycle IDs.
This value will be zero if no cycle ID was provided.
.It
.Tn "Timestamp"
.Pp
Timestamp when trace began to this destination.
.It
.Tn "DestReplied"
.Pp
Whether a response from the destination was received.
The character R is printed if a reply was received.
The character N is printed if no reply was received.
Since skitter sends a packet with a TTL of 255 when it halts probing,
it is still possible for the final destination to send a reply and
for the HaltReasonData (see below) to not equal no_halt.
Note: scamper does not perform this last-ditch probing at TTL 255 by
default.
.It
.Tn "DestRTT"
.Pp
The RTT (ms) of first response packet from destination.
This value is zero if DestReplied is N.
.It
.Tn "RequestTTL"
.Pp
TTL set in request packet which elicited a response (echo reply) from
the destination.
This value is zero if DestReplied is N.
.It
.Tn "ReplyTTL"
.Pp
TTL found in reply packet from destination.
This value is zero if DestReplied is N.
.It
.Tn "HaltReason"
.Pp
A single character corresponding to the reason, if any, why incremental
probing stopped.
S is printed if the destination was reached or there is no halt data.
U is printed if an ICMP unreachable message was received.
L is printed if a loop was detected.
G is printed if the gaplimit was reached.
.It
.Tn "HaltReasonData"
.Pp
Extra data about why probing halted.
If HaltReason is S, the zero is output.
If HaltReason is U, the ICMP code of the unreachable message is printed.
If HaltReason is L, the length of the loop is printed.
If HaltReason is G, the length of the gap is printed.
.It
.Tn "PathComplete"
.Pp
Whether all hops to destination were found.
C is printed if the trace is complete, all hops are found.
I is printed if the trace is incomplete, at least one hop is missing
(i.e., did not respond).
.It
.Tn "PerHopData"
.Pp
Response data for each hop.
If multiple IP addresses respond at the same hop, response data for each
IP address are separated by semicolons:
.Pp
IP,RTT,numTries (for only one responding IP)
IP,RTT,numTries;IP,RTT,numTries;... (for multiple responding IPs)
.Pp
where IP is the IP address which sent a TTL expired packet, RTT is the RTT
of the TTL expired packet, and numTries is the number of tries before a
response was received from the TTL.
.Pp
This field has the value 'q' if there was no response at a hop.
.Pp
If the
.Fl M
option is specified, any MPLS label stack objects embedded in the ICMP
response will be included in the following format, and the four
fields correspond to each of the fields in a MPLS header.
.Pp
.in +.3i
M|ttl|label|exp|s
.in -.3i
.Pp
If the ICMP response embeds more than one MPLS header, they are given
one at a time, each starting with an M.
.Pp
If the
.Fl Q
option is specified, the TTL value found in a quoted IP packet is included
with the following format:
.Pp
.in +.3i
Q|ttl
.in -.3i
.Pp
If the
.Fl T
option is specified, the TTL value of the response packet is included with
the following format:
.Pp
.in +.3i
T|ttl
.in -.3i
.El
.Sh EXAMPLES
The command:
.Pp
.in +.3i
sc_analysis_dump file1.warts file2.warts
.in -.3i
.Pp
will decode and print the traceroute objects in file1.warts, followed by the
traceroute objects in file2.warts.
.Pp
The command:
.Pp
.in +.3i
gzcat file1.warts.gz | sc_analysis_dump
.in -.3i
.Pp
will decode and print the traceroute objects in the uncompressed file
supplied on stdin.
.Sh BUGS
When the
.Fl e
option is used, any unresponsive hops between the last responding router
and the destination are not printed, which could imply an IP link where
none exists.
Use
.Xr sc_warts2json 1
instead.
.Sh SEE ALSO
.Xr scamper 1 ,
.Xr sc_wartsdump 1 ,
.Xr sc_warts2json 1
.Sh AUTHORS
.Nm
was written by Matthew Luckie <mjl@luckie.org.nz>.
It was derived from CAIDA's sk_analysis_dump program and should behave
in an identical manner.