Summaries

[vinegar-ip.git] / README

diff --git a/README b/README
index dc5a83bf77bb445b3414592cf27c9bed14bdecfe..f6d526488544d0543705914bacc9e77463559c7a 100644 (file)
--- a/README
+++ b/README
@@ -68,8 +68,9 @@ WHAT TO DO
        * When it has finished, kill on-dest.sh and monitor.sh.
             Copy the file recv-1.pcap back to your analysis machine, and
            there say `make anal'.
-       * This will generate `recv-1.log' and `recv-1.diff'.
-           Read the diff and see if it's by and large working.
+       * This will generate
+               recv-1.log  recv-1.diff  recv-1.mdiff  recv-1.summary
+           Read the diffs and see if it's by and large working.
            See below for information about interpreting the various files.
 
 3. Run the full test
@@ -103,6 +104,27 @@ FILES INVOLVED
 
 INTERPRETATION OF THE TEXT FILES - EXAMPLE
 
+
+You probably want to start with the recv-*.summary files.  Here's an
+example line (folded and indented here to make it easier to read:
+
+-7      80.4.4.56 > 212.22.195.1: 6.115.30.33.50 > 158.55.15.27.50: \
+     udp 37 (DF) [tos 0xaf] (ttl 255, id 55590) [tos 0x62] (ttl ###, id 21803)
+
+This means that packet no.7 either the packet didn't arrive, or
+tcpdump produced different a summary line for the second packet.
+
+The recv-*.summary and recv-*.mdiff files DO NOT contain information
+about packets whose bodies changed, unless tcpdump reported the change
+in its summary.  recv-*.diff contains ALL changes, even to meaningless
+parts of packets, except changes to the IP TTL and IP header checksum
+(which are expected to change).
+
+So, you can then look in recv-1.mdiff and recv-1.diff for more
+information about packet no.7, if you're interested.  See below for
+help on interpreting the diffs.
+
+
 Here is an example of a diff you might see:
 
 @@ -23,12 +15,7 @@
@@ -128,21 +150,20 @@ with `+', they aren't useful.  In this case, it's packet 5 that's
 missing.  So, we can look in send-1.why or send-all.why, as
 appropriate, and see this:
 
+batch  packet within batch
+   |  /
    1 5  tos=0xe7 id=30130 df (!any) proto=icmp[1] \
                  (any) type=75 (junk) l=11 code=140
        45e7002375b24000ff0152f2ac122d23ac122d064b8c34ba4844ce2d1bde5caf0ab9e6
 
-In send-all.why, these are prepended by another line number, which is
-the one you should use, so it would look like this:
+or this:
 
+        batch  packet within batch
+           |  /
      5     1 5  tos=0xe7 id=30130 df (!any) proto=icmp[1] \
-                         (any) type=75 (junk) l=11 code=140
-              45e7002375b24000ff0152f2ac122d23ac122d064b8c34ba4844ce2d\
-                                                         1bde5caf0ab9e6
-
-(The other two numbers are the batch and line within the batch.
-I have wrapped this here with \ and some indentation for ease of
-reading.)
+    /                    (any) type=75 (junk) l=11 code=140
+  overall      45e7002375b24000ff0152f2ac122d23ac122d064b8c34ba4844ce2d\
+ packet no.                                               1bde5caf0ab9e6
 
 You can see the hex dump of the packet, which is the same as the one
 in the tcpdump output, except that the tcpdump one has some extra