TRACESPLIT(1)							   User Commands						     TRACESPLIT(1)

NAME

       tracesplit - split traces

SYNOPSIS

       tracesplit [ -f bpf | --filter=bpf] [ -c count | --count=count] [ -b bytes | --bytes=bytes] [ -i seconds | --seconds=seconds] [ -s unixtime
       | --starttime=unixtime] [ -e unixtime | --endtime=unixtime] [ -m maxfiles | --maxfiles=maxfiles] [ -S snaplen  |  --snaplen=snaplen]  [	-z
       level | --compress-level=level] [ -Z method | --compress-type=method] inputuri [inputuri ...] outputuri

DESCRIPTION

       tracesplit splits the given input traces into multiple tracefiles

       -f bpf filter
	      output only packets that match tcpdump style bpf filter

       -c count
	      output  count packets per output file.  The output file will be named after the basename given in the outputuri with the packet num-
	      ber of the first packet in this file.

       -b bytes
	      output bytes bytes per file

       -i seconds
	      start a new tracefile after "seconds" seconds

       -s unixtime
	      don't output any packets before unixtime

       -e unixtime
	      don't output any packets after unixtime

       -m maxfiles
	      do not create more than "maxfiles" trace files

       -S snaplen
	      Truncate packets to "snaplen" bytes long.  The default is collect the entire packet.

       -z level
	      Compress the data using the specified compression level, ranging from 0 to 9.  Higher compression levels tend to	result	in  better
	      compression but require more processing power to compress.

       -Z compression-method
	      Compress the data using the specified compression algorithm. Accepted methods are "gzip", "bzip2", "lzo" or "none". Default value is
	      none unless a compression level is specified, in which case gzip will be used.

EXAMPLES

       create a 1MB erf trace of port 80 traffic.
       tracesplit -z 1 -Z gzip -f 'port 80' -b $[ 1024 * 1024 ]
       erf:/traces/bigtrace.gz erf:/traces/port80.gz

LINKS

       More details about tracesplit (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

SEE ALSO

       libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1), tracereport(1), tracertstats(1),  tracestats(1),  tracepkt-
       dump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1)

AUTHORS

       Perry Lorier <perry@cs.waikato.ac.nz>

tracesplit (libtrace)						   January 2011 						     TRACESPLIT(1)