Version 2 (modified by spa1, 15 years ago) (diff)


tracertstats is a libtrace program that performs simple filter-based analysis on a trace. For every filter specified, tracertstats will display packet and byte counts at regular intervals.


tracertstats [ -f | --filter bpf ] [ -i | --interval interval ] [ -c | --count count ] [ -o | --output-format csv,txt,png,html ] inputuri...


-f, --filter
Adds another bpf filter
-i, --interval
Output statistics every interval seconds of trace time
-c, --count
Output statistics every count packets
-o, --output-format
Selects the output format. These formats are described in more detail in a subsequent section

Output Formats

A regular ASCII text file. This is the default output format which is formatted nicely for human readability. This format can use up a lot of horizontal space, so may not work particularly well in 80 character wide terminals.
Comma separated values. Suitable for future analysis using a spreadsheet or other program.
PNG graphic. Produces a png graph which may or may not be comprehensible. This format is dependent on having gdc available at compile time.
Self explanatory. Produces output suitable for display as a webpage.

Note: All output formats are written to stdout so they may require re-direction.


Output the number of packets and bytes seen every 5 minutes of trace time

tracertstats -i 300 erf:trace.erf.gz

Output the number of SMTP and HTTP packets and bytes seen every minute of trace time as an HTML file

tracertstats -i 60 -f "tcp port 25" -f "tcp port 80" -o html erf:trace.erf.gz > smtp_and_http.html


  • If a simple summary of byte and packet counts for the entire trace is required, tracestats is a better tool.