trace-summary - generate network traffic summaries
trace-summary [options]
<pcap-file>|<conn-summaries>
This manual page documents briefly the trace-summary
program.
trace-summary is a Python script that generates break-downs
of network traffic, including lists of the top hosts, protocols, ports, etc.
Optionally, it can generate output separately for incoming vs. outgoing
traffic, per subnet, and per time-interval.
Per default, it assumes the input-file to be a libpcap
trace file. If it is a Bro connection log, use -c. If
input-file is not given, the script reads from stdin. It writes its
output to stdout.
- --version
- show program's version number and exit
- -h, --help
- show this help message and exit
- -b, --bytes
- count fractions in terms of bytes rather than packets/connections
- -c,
--conn-summaries
- input file contains Bro connection summaries
- --conn-version=CONN_VERSION
- when used with -c, specify '1' for use with Bro version 1.x
connection logs, or '2' for use with Bro 2.x format. '0' tries to guess
the format
- -C, --chema
- for packets: include only TCP, ignore when seq==0
- -e,
--external
- ignore strictly internal traffic
- -E EXCLUDENETS,
--exclude-nets=EXCLUDENETS
- excludes CIDRs in file from analysis
- -i ILEN,
--intervals=ILEN
- create summaries for time intervals of given length
- -l LOCALNETS,
--local-nets=LOCALNETS
- differentiate in/out based on CIDRs in file
- -n TOPX,
--topn=TOPX
- show top <n>
- -p PORTS,
--ports=PORTS
- include only ports listed in file
- -P STOREPORTS,
--write-ports=STOREPORTS
- write top total/incoming/outgoing ports into files
- -r,
--resolve-host-names
- resolve host names
- -R tag,
--R=tag
- write output suitable for R into files <tag.*>
- -s FACTOR,
--sample-factor=FACTOR
- sample factor of input
- -S SAMPLE,
--do-sample=SAMPLE
- sample input with probability (0.0 < prob < 1.0)
- -m,
--save-mem
- do not make memory-expensive statistics
- -t, --tcp
- include only TCP
- -u, --udp
- include only UDP
- -U MINTIME,
--min-time=MINTIME
- minimum time in ISO format (e.g. 2005-12-31-23-59-00)
- -v, --verbose
- show top-n for every interval
- -V MAXTIME,
--max-time=MAXTIME
- maximum time in ISO format
trace-summary was written by The Bro Project
<info@bro.org>.
This manual page was written by Raúl Benencia
<rul@kalgan.cc> for the Debian project (but may be used by
others).