tracetopends - reports the endpoints that are responsible for the most traffic
in a trace
tracetopends [ -f bpf ] [ -A addrtype ] [ -s ] [
-d ] [ -b ] [ -a ] [ -p
] [ -n topcount ] inputuri [inputuri ...]
tracetopends reports the number of bytes and packets sent and received by the
busiest endpoints observed in the input trace(s).
- -f bpf filter
- Output only packets that match tcpdump style bpf filter.
- -n top count
- Report the top N endpoints (defaults to 10).
- -A address type
- Specifies how an endpoint should be defined. Suitable options are
"mac", "v4" and "v6" which will report
endpoint stats for each observed MAC address, IPv4 address and IPv6
- Sort endpoints based on the amount of outgoing traffic (will cancel any
previous -d option. This is on by default.
- Sort endpoints based on the amount of incoming traffic (will cancel any
previous -s option.
- Sort endpoints based on the amount of IP traffic (will cancel any previous
-a or -p options. This is on by default.
- Sort endpoints based on the amount of application layer traffic (will
cancel any previous -b or -p options.
- Sort endpoints based on the amount of packets (will cancel any previous -b
or -a options.
Output is written to stdout in columns separated by blank space.
The columns are (in order):
* Endpoint address
* Time last observed
* Packets originating from the endpoint
* Bytes originating from the endpoint (IP header onwards)
* Payload originating from the endpoint (post transport header)
* Packets sent to the endpoint
* Bytes sent to the endpoint (IP header onwards)
* Payload sent to the endpoint (post transport header)
Find the IPv4 addresses that are sending the most traffic.
tracetopends -A v4 -b -s erf:trace.erf.gz
libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1),
tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1),
tracesummary(1), tracereplay(1), tracediff(1), traceends(1)
Shane Alcock <email@example.com>