---
name: "tracestats"
section: "1"
platform: "linux"
package: "libtrace-tools"
version: "3.0.22-0.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/tracestats"
---

# tracestats(1)

perform simple analysis on a trace

## NAME

tracestats - perform simple analysis on a trace

## SYNOPSIS

**tracestats** \[ -f \| --filter bpf \]... inputuri...

## DESCRPTION

tracestats reads one or more traces and outputs summaries for each trace of how many packets/bytes match each bpf filter, as well as totals.  If instead of doing this for the entire trace, but to do it for portions then use [tracertstats(1)](/tracertstats/1.md) instead.

- **-f** *bpf-filter*

  - **--filter** *bpf-filter*

  Add another bpf filter

## EXAMPLES

```
tracestats --filter 'host sundown' \
	--filter 'port http' \
	--filter 'port ftp or ftp-data' \
	--filter 'port smtp' \
	--filter 'tcp[tcpflags] & tcp-syn!=0' \
	--filter 'not ip' \
	--filter 'ether[0] & 1 == 1' \
	--filter 'icmp[icmptype] == icmp-unreach' \
	erf:/traces/trace1.gz \
	erf:/traces/trace2.gz \
```

## LINKS

More details about tracestats (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

## SEE ALSO

libtrace(3), [tracemerge(1)](/tracemerge/1.md), [tracefilter(1)](/tracefilter/1.md), [traceconvert(1)](/traceconvert/1.md), [tracesplit(1)](/tracesplit/1.md),  [tracesplit\_dir(1)](/tracesplit_dir/1.md), [tracereport(1)](/tracereport/1.md), [tracertstats(1)](/tracertstats/1.md), [tracepktdump(1)](/tracepktdump/1.md),  [traceanon(1)](/traceanon/1.md), [tracesummary(1)](/tracesummary/1.md), [tracereplay(1)](/tracereplay/1.md), [tracediff(1)](/tracediff/1.md), [traceends(1)](/traceends/1.md), [tracetopends(1)](/tracetopends/1.md)

## AUTHORS

Perry Lorier \<perry@cs.waikato.ac.nz\>