tracereport(1) [debian man page]
TRACEREPORT(1) User Commands TRACEREPORT(1) NAME
tracereport - produce various reports on a trace (or traceset) SYNOPSIS
tracereport [ -f bpf | --filter=bpf ] [ -e | --error ] [ -F | --flow ] [ -m | --misc ] [ -P | --protocol ] [ -p | --port ] [ -T | --tos ] [ -t | --ttl ] [ -O | --tcpoptions ] [ -o | --synoptions ] [ -n | --nlp ] [ -d | --direction ] [ -C | --ecn ] [ -s | --tcpsegment ] inputuri... tracereport -H | --help DESCRIPTION
tracereport can produce a variety of reports on the properties of a trace. The user specifies the reports required using command-line options. -f bpf-filter --filter bpf-filter Only report on packets that match the provided bpf filter. See tcpdump(1) for the syntax of the bpf-filter expression. -e --error Produce a report on packet errors (e.g checksum failures, rxerrors) -F --flow Produces a report on the number of flows observed in the trace -m --misc Provides a report listing the time of the first packet, and the time of the last packet in the trace, the duration, the total number of packets in the trace, and the average number of packets per second. -P --protocol Produces a report on which transport layer protocols are observed in the trace -p --port Produces a report on which port numbers are observed in the trace -T --tos Produces a report on the contents of the IP header's ToS field -t --ttl Produces a report on the TTL of packets in the trace -O --tcpoptions Produces a report on which TCP options are observed on all packets in the trace -o --synoptions Produces a report on which combinations of TCP options are observed on SYN packets in the trace -n --nlp Produces a report on the network layer protocols observed in the trace -d --direction Produces a report on how much traffic is travelling in each direction -C --ecn Produces a report on the usage of the ECN field of the TCP header -s --tcpsegment Produces a report on the sizes of TCP segments in the trace -H --help Provides usage instructions LINKS
More details about tracereport (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation SEE ALSO
libtrace(3), tracemerge(1), tracesplit(1), tracesplit_dir(1), tracefilter(1), traceconvert(1), tracestats(1), tracertstats(1), tracere- port(1), tracepktdump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1) AUTHORS
Perry Lorier <perry@cs.waikato.ac.nz> tracereport (libtrace) October 2006 TRACEREPORT(1)
Check Out this Related Man Page
flow-stat(1) General Commands Manual flow-stat(1) NAME
flow-stat -- Generate reports with flow data. SYNOPSIS
flow-stat [-hnpPw] [-d debug_level] [-f format] [-S sort_field] [-s sort_field] [-t tally_lines] [-T title] DESCRIPTION
The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags. OPTIONS
-d debug_level Enable debugging. -f format Report format. Choose from the following: 0 Overall Summary 1 Average packet size distribution 2 Packets per flow distribution 3 Octets per flow distribution 4 Bandwidth per flow distribution 5 UDP/TCP destination port 6 UDP/TCP source port 7 UDP/TCP port 8 Destination IP 9 Source IP 10 Source/Destination IP 11 Source or Destination IP 12 IP protocol 13 octets for flow duration plot data 14 packets for flow duration plot data 15 short summary 16 IP Next Hop 17 Input interface 18 Output interface 19 Source AS 20 Destination AS 21 Source/Destination AS 22 IP ToS 23 Input/Output Interface 24 Source Prefix 25 Destination Prefix 26 Source/Destination Prefix 27 Exporter IP 28 Engine Id 29 Engine Type 30 Source Tag 31 Destination Tag 32 Source/Destination Tag -h Display help. -n Use symbolic names where appropriate. -p Display header information. -P Report as percent total. -s sort_field Sort ascending on field sort_field. -S sort_field Sort descending on field sort_field. -t tally_lines Tally totals every tally_lineslines. -T title Set report title to title. -w Wide output. EXAMPLES
Provide a report on top source/destination IP pairs sorted by octets, report in percent total form for the flows in /flows/krc4. Use the preload option to flow-cat to preserve meta information and display it with flow-stat. flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4 EXAMPLES
Many times a campus network will have a single border router which has one interface pointing to the internal side and many interfaces pointing to other providers. These interfaces each have a unique numerical id known in SNMP terms as an ifIndex. The ifIndex to interface name mappings can be determined by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib ifmib ifindex' or JunOS 'show interfaces'. Once the ifIndex for each interface is known flow-filter can be combined with flow-stat to pro- vide reports such as inbound vs outbound top src/destination IP addresses. Provide a top source IP address report by outbound traffic, ie the top senders of traffic on the campus network. Assume the ifIndex of the campus interface is 5. flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3 EXAMPLES
Provide a top destination IP address report by outbound traffic, ie the top sinks of traffic on the campus network. Assume the ifIndex of the campus interface is 5. flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3 EXAMPLES
Provide a top source/destination AS report. Use symbolic names. flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4 BUGS
None known. AUTHOR
Mark Fullmer maf@splintered.net SEE ALSO
flow-tools(1) flow-stat(1)