tracemerge is a libtrace tool that will merge together two (or more) traces into a single trace file.

Usage

tracemerge [ -i | --set-interface ] [ -u | --unique-packets ] outputuri inputuri...

Options

-i, --set-interface

Replace the direction/interface bit in the format header based on which input trace the packet comes from, e.g. direction is 0 for packets from the first input file, 1 for packets from the second file, etc.

-u, --unique-packets

Ignore duplicate packets with identical timestamps

Applications

Concatenating traces

tracemerge erf:merged_trace.gz erf:small_traces-*.gz

Merging two directions back into a single trace

tracemerge -i erf:merged_trace.gz erf:outgoing.gz erf:incoming.gz

Note: most libtrace applications regard a direction of 0 as outgoing and a direction of 1 as incoming, so be sure to specify the input URIs in the correct order.

Notes

• The output trace format does not have to match the input formats, e.g. tracemerge pcapfile:merged_trace.pcap.gz erf:small_traces-*.gz will work. There is also no requirement for the input traces to all be of the same format either. These properties hold true for all libtrace applications, although format header information can be lost converting from one format to another, e.g. pcap headers have no space to store the ERF rxerror variable.
• As the name implies, tracemerge will produce a trace where the packets are all in timestamp order.