---
name: "tracertstats"
section: "1"
platform: "linux"
package: "libtrace-tools"
version: "3.0.22-0.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/tracertstats"
---

# tracertstats(1)

perform simple filter based analysis on a trace

## NAME

tracertstats - perform simple filter based analysis on a trace

## SYNOPSIS

**tracertstats** \[ -f \| --filter bpf \] \[ -i \| --interval interval \] \[ -c \| --count count \] \[ -o \| --output-format csv,txt,png,html \] \[ -m \| --merge-inputs \] inputuri...

**tracertstats** -H\|--libtrace-help

## DESCRPTION

tracertstats takes a list of bpf expressions and outputs the number of packets and bytes that match that expression every interval seconds, or count packets.

- **-f** *bpf-filter*

  - **--filter** *bpf-filter*

  Add another "bpf filter"

- **-i** *interval*

  - **--interval** *interval*

  Output results every *interval* seconds.

- **-c** *count*

  - **--count** *count*

  Output results every *count* packets.

- **-m**

  - **--merge-inputs**

  Treats all inputs as a single input, resulting a single unified output rather than an output for each input. Works best with traces that are consecutive to create a single CSV, for instance.

- **-o** *format*

  - **--output-format** *format*

  Selects the output format.

  - txt

    Human readable text.  This is the default output format which provides output easily understood by a human.  This format has the disadvantage that it takes up quite a bit of horizontal space.

  - csv

    Comma Seperated Values. This is suitable for further analysis in a spreadsheet, or other program.

  - png

    PNG Graphic.  Produces a fairly incomprehensible png graph.  This relies on gdc being available at compile time.

  - html

    This produces output suitable for display to a human in a webbrowser.

## EXAMPLES

```
tracertstats --filter 'host sundown' \
	--filter 'port http' \
	--filter 'port ftp or ftp-data' \
	--filter 'port smtp' \
	--filter 'tcp[tcpflags] & tcp-syn!=0' \
	--filter 'not ip' \
	--filter 'ether[0] & 1 == 1' \
	--filter 'icmp[icmptype] == icmp-unreach' \
	--output-format html
	erf:/traces/trace1.gz \
	erf:/traces/trace2.gz
```

## LINKS

More details about tracertstats (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

## SEE ALSO

libtrace(3), [tracemerge(1)](/tracemerge/1.md), [tracesplit(1)](/tracesplit/1.md), [tracesplit\_dir(1)](/tracesplit_dir/1.md), [tracefilter(1)](/tracefilter/1.md),  [traceconvert(1)](/traceconvert/1.md), [tracereport(1)](/tracereport/1.md), [tracepktdump(1)](/tracepktdump/1.md), [traceanon(1)](/traceanon/1.md), [tracesummary(1)](/tracesummary/1.md), [traceconvert(1)](/traceconvert/1.md), [tracereplay(1)](/tracereplay/1.md), [tracediff(1)](/tracediff/1.md), [traceends(1)](/traceends/1.md), [tracetopends(1)](/tracetopends/1.md)

## AUTHORS

Perry Lorier \<perry@cs.waikato.ac.nz\>