tracesplit will split a single trace into a number of smaller tracefiles.

Usage

tracesplit [ -f exp | --filter=exp ] [ -c num | --count=num ] [ -b num | --bytes=num ] [ -i secs | --interval=secs ] [ -s unixtime | --starttime=unixtime ] [ -e unixtime | --endtime=unixtime ] [ -m files | --maxfiles=files] inputuri outputuri

Options

-f, --filter

Only output packets that match the bpf filter expression. See tcpdump(1) for the syntax of the bpf filter expression

-c, --count

Output count packets per output file.

-b, --bytes

Output num bytes per output file.

-i, --interval

Start a new file after secs seconds of trace time.

-s, --starttime

Do not output any packets with a timestamp earlier than unixtime

-e, --endtime

Do not output any packets with a timestamp later than unixtime

-m, --maxfiles

Do not create more than files trace files

Applications

Create a small 10 minute trace from a larger trace

tracesplit -i 600 -m 1 erf:longtrace.erf.gz erf:10min_trace.erf.gz

Capture a trace to disk with a one hour file rotation

tracesplit -i 3600 int:eth0 erf:trace.erf.gz

Notes

• As tracesplit is capable of producing multiple output files, the output URI is used as the base of the output filename. Appended is timestamp of the first packet in the subtrace.