Skip to main content

Analyze mptcp traces (.pcap)

Project description

Documentation (latest) Dev doc
Documentation (stable) Master doc
License License
Build Status Build status
PyPI PyPI package
built with nix


Mptcpanalyzer is a python tool conceived to help with MPTCP pcap analysis (as mptcptrace for instance).

It accepts as input a capture file (.pcap or .pcapng) and from there generates a CSV file (thanks to tshark, the terminal version of wireshark) with the MPTCP fields required for analysis. From there you can:

  • list MPTCP connections
  • compute statistics on a specific MPTCP connection (list of subflows, reinjections, subflow actual contributions...) It accepts as input a capture file (*.pcap) and depending on from there can :
  • export a CSV file with MPTCP fields
  • plot one way delays
  • ...

Most commands are self documented and/or with autocompletion.

Then you have an interpreter with autocompletion that can generate & display plots such as the following:

Data Sequence Number (DSN) per subflow plot

You can reference mptcpanalyzer via the following Digital Object Identifier: DOI

Table of Contents


You will need a wireshark version >= 3.0.0

Once wireshark is installed you can install mptcpanalyzer via pip: $ python3 -mpip install mptcpanalyzer --user

python 3.7 is mandatory since we rely on its type hinting features. Dependancies are (some will be made optional in the future):

  • stevedore to manage plugins
  • the data analysis library pandas
  • lnumexpr to run specific queries in pandas
  • matplotlib to plot graphs
  • cmd2 to generate the command line

Run the checkhealth command in case of problems.

How to use ?

mptcpanalyzer can run into 3 modes:

  1. interactive mode (default): an interpreter with some basic completion will accept your commands. There is also some help embedded.
  2. if a filename is passed as argument, it will load commands from this file
  3. otherwise, it will consider the unknow arguments as one command, the same that could be used interactively

For example, we can load an mptcp pcap (I made one available on wireshark wiki or in this repository, in the examples folder).

Run $ mptcpanalyzer --load examples/iperf-mptcp-0-0.pcap. The script will try to generate a csv file, it can take a few minutes depending on the computer/pcap until the prompt shows up. Type ? to list available commands (and their aliases). You have for instance:

  • lc (list connections)
  • ls (list subflows)
  • plot
  • ...

help ls will return the syntax of the command, i.e. ls [] where is one of the number appearing in lc output.

Look at Examples


Head to the Wiki for more examples.

Plot One Way Delays from a connection: plot owd tcp examples/client_2_filtered.pcapng 0 examples/server_2_filtered.pcapng 0 --display

Plot tcp sequence numbers in both directions: plot tcp_attr -h

Get a summary of an mptcp connection

> load_pcap examples/server_2_filtered.pcapng
> mptcp_summary 0

Map between server and client pcaps:

>map_tcp_connection examples/client_1_tcp_only.pcap examples/server_1_tcp_only.pcap  0
>print_owds examples/client_1_tcp_only.pcap examples/server_1_tcp_only.pcap 0 0

Map between server and client pcaps:

> map_mptcp_connection examples/client_2_filtered.pcapng examples/client_2_filtered.pcapng 0
2 mapping(s) found
0 <-> 0.0 with score=inf  <-- should be a correct match 0:  <->  (mptcpdest: Server) mapped to 0:  <->  (mptcpdest: Server) with score=inf 2:  <->  (mptcpdest: Server) mapped to 2:  <->  (mptcpdest: Server) with score=inf 4:  <->  (mptcpdest: Server) mapped to 4:  <->  (mptcpdest: Server) with score=inf 6:  <->  (mptcpdest: Server) mapped to 6:  <->  (mptcpdest: Server) with score=inf
0 <-> 1.0 with score=0 0:  <->  (mptcpdest: Server) mapped to 1:  <->  (mptcpdest: Server) with score=30 2:  <->  (mptcpdest: Server) mapped to 3:  <->  (mptcpdest: Server) with score=30 4:  <->  (mptcpdest: Server) mapped to 5:  <->  (mptcpdest: Server) with score=30 6:  <->  (mptcpdest: Server) mapped to 7:  <->  (mptcpdest: Server) with score=30


Moved to the Wiki

How to contribute

PRs welcome ! See the doc.

Related tools

Similar software:

Tool Description
mptcptrace C based: an example
mptcpplot C based developed at NASA: generated output example

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mptcpanalyzer-0.3.2.tar.gz (36.4 MB view hashes)

Uploaded source

Built Distribution

mptcpanalyzer-0.3.2-py3-none-any.whl (95.1 kB view hashes)

Uploaded py3

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page