TRACESTATS(1) User Commands TRACESTATS(1)
NAME
tracestats - perform simple analysis on a trace
SYNOPSIS
tracestats [ -f | --filter bpf ]... inputuri...
DESCRPTION
tracestats reads one or more traces and outputs summaries for each trace of how many packets/bytes match each bpf filter, as well as
totals. If instead of doing this for the entire trace, but to do it for portions then use tracertstats(1) instead.
-f bpf-filter
--filter bpf-filter
Add another bpf filter
EXAMPLES
tracestats --filter 'host sundown'
--filter 'port http'
--filter 'port ftp or ftp-data'
--filter 'port smtp'
--filter 'tcp[tcpflags] & tcp-syn!=0'
--filter 'not ip'
--filter 'ether[0] & 1 == 1'
--filter 'icmp[icmptype] == icmp-unreach'
erf:/traces/trace1.gz
erf:/traces/trace2.gz
LINKS
More details about tracestats (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation
SEE ALSO
libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit(1), tracesplit_dir(1), tracereport(1), tracertstats(1), tracepkt-
dump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1)
AUTHORS
Perry Lorier <perry@cs.waikato.ac.nz>
tracestats (libtrace) October 2005 TRACESTATS(1)
