wiki:TraceDiff

tracediff reports differences in packets between two trace files.

Usage

tracediff [ -m maxdiff ] firstURI secondURI

Options

-m
Stop processing after displaying this many different packets

Applications

Report the first 10 differences between an original ERF trace and the converted PCAP version

tracediff -m 10 erf:orig.erf.gz pcapfile:convert.pcap.gz

Notes

  • The contents of the framing headers, e.g. PCAP or ERF encapsulation, are not compared.
  • This tool is primarily intended to verify the integrity of traces or test if two traces are the same. Running tracediff against two entirely different traces will create a LOT of output!
Last modified 9 years ago Last modified on 02/28/11 16:48:17