man(1)

NAME
mptcpsplit - Split out an individual MPTCP connection from a pcap file.

SYNOPSIS
mptcpsplit [-h] [-l] [-n connection_num] [-o outfile] pcap_filename

DESCRIPTION
mptcpsplit is a tool for learning about MPTCP connections in the pcap file pcap_filename. There are currently three main modes of operation for mptcpsplit.
1 | Listing out all MPTCP connections in a pcap with the option. Connections are only listed when enough information about the MP_CAPABLE handshake is available in the pcap. If a trace only contains packets from the middle of an MPTCP connection it will not be listed.
2 | Splitting out a single MPTCP connection into a separate pcap with use of the option. The numerical argument selects which connection will be output using a 0-based index. The indices for each available connection are in the output of the option.
3 | Splitting out TCP packets (that may potentially carry MPTCP options) that are not able to be considered as part of a particular MPTCP connection in For example, plain TCP packets or MP_JOIN subflows whose token does not match any connection in would have their packets split out into a separate pcap.

EXAMPLES

mptcpsplit pcap_filename
    Read in pcap_filename and output all TCP packets associated without an MPTCP connection association to the file outfile.pcap.

mptcpsplit -l pcap_filename
    Read in pcap_filename and output a list of MPTCP connections contained in the file. Connections are counted only if the start of the connection (MP_CAPABLE handshake) is contained in pcap_filename. Output lines have five fields in the following order: four_tuple connection_num first_timestamp last_timestamp duration

mptcpsplit -n connection_num  pcap_filename
    Read in pcap_filename and write all packets belonging to connection connection_num to the file outfile.pcap. To figure out what value to use for connection_num, the easiest thing to do is run mptcpsplit with the -l option.

mptcpsplit -n connection_num -o outfile pcap_filename
    Same as previous example, but write packets to the file given by outfile rather than the default filename of outfile.pcap.

POSITIONAL ARGUMENTS

  Required arguments

pcap_filename
    mptcpsplit will read packets from pcap_filename and perform operations on these packets based on the combination of other options specified when mptcpsplit is run. Exactly one pcap file must be passed to mptcpsplit, or else the program will exit on an error.

OPTIONS

  General options

-h  Print out a help dialogue and exit.

-l  Print the connections contained in pcap_filename to stdout. Each connection lists its four-tuple, connection number, first packet timestamp, last packet timestamp, and duration. Example: 10.155.0.2:58865:10.155.0.1:4401 0 1479480064.900667 1479480133.679078 68.778411 10.155.0.2:58867:10.155.0.1:4401 1 1479480445.142297 1479480526.169200 81.026903 10.155.1.2:46016:10.155.0.1:4401 2 1479480635.459295 1479481353.256593 717.797298 Connections are only listed if the MP_CAPABLE handshake is captured in pcap_filename for that particular connection. The four-tuple listed corresponds to the four-tuple of the first subflow for the MPTCP connection.

-n connection_num
    Write all packets belonging to connection number connection_num to the file outfile.pcap.

-o outfile
    Write packets to outfile rather than the default file outfile.pcap.

LIMITATIONS
mptcpsplit is still under development and may not work under certain conditions due to incomplete code. Known limitations include:

No IPv6 support
    Currently only IPv4 is supported. IPv6 support is planned for future releases.

Little-Endian Only
    mptcpsplit has only been developed and tested on little-endian machines. Certain code (like bitfields) may need to be reworked to support big-endian machines.

AUTHORS
Matt Sargent