tracertstats is a libtrace program that performs simple filter-based analysis on a trace. For every filter specified, tracertstats will display packet and byte counts at regular intervals.

Usage

tracertstats [ -f | --filter bpf ] [ -i | --interval interval ] [ -c | --count count ] [ -o | --output-format csv,txt,png,html ] inputuri...

Options

-f, --filter

Adds another bpf filter

-i, --interval

Output statistics every interval seconds of trace time

-c, --count

Output statistics every count packets

-o, --output-format

Selects the output format. These formats are described in more detail in a subsequent section

Output Formats

txt

A regular ASCII text file. This is the default output format which is formatted nicely for human readability. This format can use up a lot of horizontal space, so may not work particularly well in 80 character wide terminals.

csv

Comma separated values. Suitable for future analysis using a spreadsheet or other program.

png

PNG graphic. Produces a png graph which may or may not be comprehensible. This format is dependent on having gdc available at compile time.

html

Self explanatory. Produces output suitable for display as a webpage.

Note: All output formats are written to stdout so they may require re-direction.

Applications

Output the number of packets and bytes seen every 5 minutes of trace time

tracertstats -i 300 erf:trace.erf.gz

Output the number of SMTP and HTTP packets and bytes seen every minute of trace time as an HTML file

tracertstats -i 60 -f "tcp port 25" -f "tcp port 80" -o html erf:trace.erf.gz > smtp_and_http.html