NAME

       tracertstats - perform simple filter based analysis on a trace

SYNOPSIS

       tracertstats  [  -f | --filter bpf ] [ -i | --interval interval ] [ -c | --count count ] [
       -o | --output-format csv,txt,png,html ] [ -m | --merge-inputs ] inputuri...

       tracertstats -H|--libtrace-help

DESCRPTION

       tracertstats takes a list of bpf expressions and outputs the number of packets  and  bytes
       that match that expression every interval seconds, or count packets.

       -f bpf-filter
       --filter bpf-filter
              Add another "bpf filter"

       -i interval
       --interval interval
              Output results every interval seconds.

       -c count
       --count count
              Output results every count packets.

       -m
       --merge-inputs
              Treats  all inputs as a single input, resulting a single unified output rather than
              an output for each input. Works best with traces that are consecutive to  create  a
              single CSV, for instance.

       -o format
       --output-format format
              Selects the output format.

              txt    Human  readable  text.   This  is  the  default output format which provides
                     output easily understood by a human.  This format has the disadvantage  that
                     it takes up quite a bit of horizontal space.

              csv    Comma  Seperated  Values.  This  is  suitable  for  further  analysis  in  a
                     spreadsheet, or other program.

              png    PNG Graphic.  Produces a fairly incomprehensible png graph.  This relies  on
                     gdc being available at compile time.

              html   This produces output suitable for display to a human in a webbrowser.

EXAMPLES

       tracertstats --filter 'host sundown' \
            --filter 'port http' \
            --filter 'port ftp or ftp-data' \
            --filter 'port smtp' \
            --filter 'tcp[tcpflags] & tcp-syn!=0' \
            --filter 'not ip' \
            --filter 'ether[0] & 1 == 1' \
            --filter 'icmp[icmptype] == icmp-unreach' \
            --output-format html
            erf:/traces/trace1.gz \
            erf:/traces/trace2.gz

LINKS

       More     details    about    tracertstats    (and    libtrace)    can    be    found    at
       http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

SEE ALSO

       libtrace(3),    tracemerge(1),    tracesplit(1),    tracesplit_dir(1),     tracefilter(1),
       traceconvert(1),    tracereport(1),    tracepktdump(1),   traceanon(1),   tracesummary(1),
       traceconvert(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1)

AUTHORS

       Perry Lorier <perry@cs.waikato.ac.nz>