SYNOPSIS
tracetopends [ -f bpf ] [ -A addrtype ] [ -s ] [ -d ] [ -b ] [ -a ] [ -p ] [ -n topcount ] inputuri [inputuri ...]DESCRIPTION
tracetopends reports the number of bytes and packets sent and received by the busiest endpoints observed in the input trace(s).- -f bpf filter
- Output only packets that match tcpdump style bpf filter.
- -n top count
- Report the top N endpoints (defaults to 10).
- -A address type
- Specifies how an endpoint should be defined. Suitable options are "mac", "v4" and "v6" which will report endpoint stats for each observed MAC address, IPv4 address and IPv6 address respectively.
- -s
- Sort endpoints based on the amount of outgoing traffic (will cancel any previous -d option. This is on by default.
- -d
- Sort endpoints based on the amount of incoming traffic (will cancel any previous -s option.
- -b
- Sort endpoints based on the amount of IP traffic (will cancel any previous -a or -p options. This is on by default.
- -a
- Sort endpoints based on the amount of application layer traffic (will cancel any previous -b or -p options.
- -p
- Sort endpoints based on the amount of packets (will cancel any previous -b or -a options.
OUTPUT
Output is written to stdout in columns separated by blank space.
The columns are (in order):
* Endpoint address
* Time last observed
* Packets originating from the endpoint
* Bytes originating from the endpoint (IP header onwards)
* Payload originating from the endpoint (post transport header)
* Packets sent to the endpoint
* Bytes sent to the endpoint (IP header onwards)
* Payload sent to the endpoint (post transport header)
EXAMPLES
Find the IPv4 addresses that are sending the most traffic.tracetopends -A v4 -b -s erf:trace.erf.gz