---
name: "trace-summary"
section: "1"
platform: "linux"
package: "trace-summary"
version: "0.93-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/trace-summary"
---

# trace-summary(1)

generate network traffic summaries

## NAME

trace-summary - generate network traffic summaries

## SYNOPSIS

**trace-summary** \[*options*\] *\<pcap-file\>\|\<conn-summaries\>*

## DESCRIPTION

This manual page documents briefly the **trace-summary** program.

**trace-summary** is a Python script that generates break-downs of network traffic, including lists of the top hosts, protocols, ports, etc. Optionally, it can generate output separately for incoming vs. outgoing traffic, per subnet, and per time-interval.

Per default, it assumes the *input-file* to be a libpcap trace file. If it is a Bro connection log, use **-c**. If *input-file* is not given, the script reads from stdin. It writes its output to stdout.

## OPTIONS

- **--version**

  show program's version number and exit

- **-h**, **--help**

  show this help message and exit

- **-b**, **--bytes**

  count fractions in terms of bytes rather than packets/connections

- **-c**, **--conn-summaries**

  input file contains Bro connection summaries

- **--conn-version**=*CONN\_VERSION*

  when used with **-c**, specify '1' for use with Bro version 1.x connection logs, or '2' for use with Bro 2.x format. '0' tries to guess the format

- **-C**, **--chema**

  for packets: include only TCP, ignore when seq==0

- **-e**, **--external**

  ignore strictly internal traffic

- **-E** EXCLUDENETS, **--exclude-nets**=*EXCLUDENETS*

  excludes CIDRs in file from analysis

- **-i** ILEN, **--intervals**=*ILEN*

  create summaries for time intervals of given length

- **-l** LOCALNETS, **--local-nets**=*LOCALNETS*

  differentiate in/out based on CIDRs in file

- **-n** TOPX, **--topn**=*TOPX*

  show top \<n\>

- **-p** PORTS, **--ports**=*PORTS*

  include only ports listed in file

- **-P** STOREPORTS, **--write-ports**=*STOREPORTS*

  write top total/incoming/outgoing ports into files

- **-r**, **--resolve-host-names**

  resolve host names

- **-R** tag, **--R**=*tag*

  write output suitable for R into files \<tag.\*\>

- **-s** FACTOR, **--sample-factor**=*FACTOR*

  sample factor of input

- **-S** SAMPLE, **--do-sample**=*SAMPLE*

  sample input with probability (0.0 \< prob \< 1.0)

- **-m**, **--save-mem**

  do not make memory-expensive statistics

- **-t**, **--tcp**

  include only TCP

- **-u**, **--udp**

  include only UDP

- **-U** MINTIME, **--min-time**=*MINTIME*

  minimum time in ISO format (e.g. 2005-12-31-23-59-00)

- **-v**, **--verbose**

  show top-n for every interval

- **-V** MAXTIME, **--max-time**=*MAXTIME*

  maximum time in ISO format

## AUTHOR

**trace-summary** was written by The Bro Project \<info@bro.org\>.

This manual page was written by Raúl Benencia \<rul@kalgan.cc\> for the Debian project (but may be used by others).