 MATLAB
 Queue Analysis
 Stationarity Plot
 Attacks
 IP Addresses Analysis
 Part Trace Analysis
 UDP Payload
 setLisner New (v. 0.2)
 Command Line
 C++ Library
MATLAB Library
 Queue Analysis

In order to properly compute the queue behaviour you need packet arrival time and length. In order to read those information you need to use
Now we have information about arrival time separately for seconds and micro seconds. In order to obtain time in seconds and normalize the starting time we have to
The next move is simply adding information about packet size by
If you wish you can download a simple MATLAB function pointProcessRead.m which takes a file name and returns a matrix where the first column is time and the second column is packet size.
 Simple Trace Analysis

It is very useful to see if the analyzed trace is a typical one i.e. is the packets and bytes arrival process approximately stationary and what is the packets distribution.
basicTracePlots.m generates three simple plots showing those properties.
 Attacks

Terry Brugger in „Data Mining Methods for Network Intrusion Detection” sumarised numerous different intrussion detection algorithms.
The most commonly used by fields are timestemp, source IP, destination IP, source port, destination port and the protocol type.
All those fields cen be read by comment
for TCP
for UDP
 IP Addresses Analysis

In many cases we would like to compare IP addresses from packet headers with predefined address or range of addresses.
All variables from packet headers are presented by the TracesPlay in decimal format. As a consequence, in Matlab we need
to change the input String to decimal format e.g '192.168.0.1' > 3232235521. We present an example of Matlab function
ipAddressesAnalysis.m, where we check how many packets are originated from the specified
range (which is given as input parameters e.g. 192.168.0.0 255.255.0.0).
The aim is to check the amount of TCP, UDP and ICMP packets originated from the specified range.
 Part Trace Analysis

If your trace is too large to fit to the memory or you are interested in a part of the trace you can read just part of it using n option. For example
reads first 1000 IP source addresses.
Than we can read next 1000 packets by using
and finally to read all the rest packets we can use
 UDP Payload

There is an option making it possible to read UDP payload by using
where 10 means that you are interested in reading first 10 bytes of payload.
The returned matrix contains the read bytes number (in the first row) and the bytes values (in the next rows) or zero if we asked for more bytes than there is in the file. So if you have a single UDP packet with a payload of 30 bytes than returns a vector of 11 integres, where the first one is 11 (the last usefull byte) and 10 next values are the first 10 bytes of payload. If you use 40 in stead of 10 i.e. you run you will get a vector of length 41 which first value is 31 since the 31st value of this vector is caring payload byte. The next values are zeros i.e. values from 32 to 41. Note that if Data(31)==0 it means that the last written byte of this UDP packet was 0.
 setLisner
New (v. 0.2) 
Some simple example to show how work setLinser feature in Matlab
And Matlab function that we have is
After execut this sample, we recive on Matlab console.
Of course this is only easy sample, you can write any Matlab function that will be handled (runed) from TracesPlay
Command Line
C++ Library
 Display packet number and IP src addres

You can use TracesPlay as library. In order to catch IP source addres from stream you need to use this source.
Also it is fast and short example who easy in work is TracesPlay also as library.