pt-tcp-model – Transform tcpdump into metrics that permit performance and scalability modeling.

pt-tcp-model [OPTION…] [FILE]
pt-tcp-model parses and analyzes tcpdump files. With no FILE, or when FILE is -, it read standard input.

Dump TCP requests and responses to a file, capturing only the packet headers to avoid dropped packets, and ignoring any packets without a payload (such as ack-only packets). Capture port 3306 (MySQL database traffic). Note that to avoid line breaking in terminals and man pages, the TCP filtering expression that follows has a line break at the end of the second line; you should omit this from your tcpdump command.

tcpdump -s 384 -i any -nnq -tttt \
‘tcp port 3306 and (((ip[2:2] – ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’ \
> /path/to/tcp-file.txt
Extract individual response times, sorted by end time:

pt-tcp-model /path/to/tcp-file.txt > requests.txt
Sort the result by arrival time, for input to the next step:

sort -n -k1,1 requests.txt > sorted.txt
Slice the result into 10-second intervals and emit throughput, concurrency, and response time metrics for each interval:

pt-tcp-model –type=requests –run-time=10 sorted.txt > sliced.txt
Transform the result for modeling with Aspersa’s usl tool, discarding the first and last line of each file if you specify multiple files (the first and last line are normally incomplete observation periods and are aberrant):

for f in sliced.txt; do
tail -n +2 “$f” | head -n -1 | awk ‘{print $2, $3, $7/$4}’
done > usl-input.txt