Version 3 (modified by spa1, 14 years ago) (diff) |
---|
tracesplit will split a single trace into a number of smaller tracefiles.
Usage
tracesplit [ -f exp | --filter=exp ] [ -c num | --count=num ] [ -b num | --bytes=num ] [ -i secs | --interval=secs ] [ -s unixtime | --starttime=unixtime ] [ -e unixtime | --endtime=unixtime ] [ -m files | --maxfiles=files] inputuri outputuri
Options
- -f, --filter
- Only output packets that match the bpf filter expression. See tcpdump(1) for the syntax of the bpf filter expression
- -c, --count
- Output count packets per output file.
- -b, --bytes
- Output num bytes per output file.
- -i, --interval
- Start a new file after secs seconds of trace time.
- -s, --starttime
- Do not output any packets with a timestamp earlier than unixtime
- -e, --endtime
- Do not output any packets with a timestamp later than unixtime
- -m, --maxfiles
- Do not create more than files trace files
Applications
Create a small 10 minute trace from a larger trace
tracesplit -i 600 -m 1 erf:longtrace.erf.gz erf:10min_trace.erf.gz
Capture a trace to disk with a one hour file rotation
tracesplit -i 3600 int:eth0 erf:trace.erf.gz
Notes
- As tracesplit is capable of producing multiple output files, the output URI is used as the base of the output filename. Appended is timestamp of the first packet in the subtrace.