| 2 | |
| 3 | == Things all tools can do == |
| 4 | All tools can read off a network with {{{int:}}}/{{{bpf:}}}/{{{pcapint:}}}/{{{dag:}}}, or from stdin with {{{pcapfile:-}}}/{{{pcap:-}}}/{{{erf:-}}}/{{{legacypos:-}}}/{{{legacyatm:-}}}/{{{legacyeth:-}}}. |
| 5 | |
| 6 | All tools can write to a network with {{{int:}}}/{{{pcapint:}}}, or to standard out with {{{pcapfile:-}}}/{{{pcap:-}}} |
| 7 | |
| 8 | == Investigate whats in a trace == |
| 9 | {{{ |
| 10 | tracedump erf:trace.erf |
| 11 | }}} |
| 12 | |
| 13 | == Get some stats about a interface/trace == |
| 14 | {{{ |
| 15 | tracertstats int:eth0 |
| 16 | }}} |
| 17 | substitute {{{int:eth0}}} for {{{pcapfile:trace.gz}}} to produce stats on a trace. |
| 18 | |
| 19 | == Get more detailed stats on a trace == |
| 20 | {{{ |
| 21 | tracesummary pcapfile:foo.pcap.gz |
| 22 | tracereport pcapfile:foo.pcap.gz |
| 23 | tracertstats pcapfile:foo.pcap.gz |
| 24 | }}} |
| 25 | Note that {{{tracereport}}}/{{{tracesummary}}} waits for its input to complete, since an interface never completes it won't ever finish tallying results. |
| 26 | |
| 27 | == To merge two directions back into one file == |
| 28 | {{{ |
| 29 | tracemerge -i pcapfile:foo-combined.gz pcapfile:foo-in.pcap.gz pcapfile:foo-out.gz |
| 30 | }}} |
| 31 | |
| 32 | == To concatenate traces together == |
| 33 | {{{ |
| 34 | tracemerge -s erf:out.gz erf:in-*.gz |
| 35 | }}} |
21 | | |
22 | | == Investigate whats in a trace == |
23 | | {{{ |
24 | | tracedump erf:trace.erf |
25 | | }}} |
26 | | |
27 | | == To merge two directions back into one file == |
28 | | {{{ |
29 | | tracemerge -i pcapfile:foo-combined.gz pcapfile:foo-in.pcap.gz pcapfile:foo-out.gz |
30 | | }}} |
31 | | |
32 | | == To concatenate traces together == |
33 | | {{{ |
34 | | tracemerge -s erf:out.gz erf:in-*.gz |
35 | | }}} |
36 | | |
37 | | == Things all tools can do == |
38 | | All tools can read off a network with {{{int:}}}/{{{bpf:}}}/{{{pcapint:}}}/{{{dag:}}}, or from stdin with {{{pcapfile:-}}}/{{{pcap:-}}}/{{{erf:-}}}/{{{legacypos:-}}}/{{{legacyatm:-}}}/{{{legacyeth:-}}}. |
39 | | |
40 | | All tools can write to a network with {{{int:}}}/{{{pcapint:}}}, or to standard out with {{{pcapfile:-}}}/{{{pcap:-}}} |