TRACE-SUMMARY(1)

📦
version 6.0.4 · 2 versions
, in epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable

💖 TRACE-SUMMARY(1) 💖

okay bestie, welcome to the trace-summary manual page — she's a User Command, she's iconic, she's about to tell you everything about your network traffic. no cap. 🦋

✨ NAME ✨

trace-summary — generate network traffic summaries 👑

🌸 SYNOPSIS 🌸

trace-summary [options] [input-file]

💅 DESCRIPTION 💅

trace-summary generates break-downs of network traffic, and honestly? it's giving data. we're talking lists of the top hosts, protocols, ports, etc. — the whole main character lineup. ✨

and if you want, she can also generate output separately for incoming vs. outgoing traffic, per subnet, and per time-interval. like, she's flexible. she contains multitudes. 💜

per default, she assumes the input-file to be a libpcap trace file. that's the default vibe. BUT — if it's a Zeek connection log, use -c. and if input-file is not given at all? she just reads from stdin. no biggie. she writes her output to stdout. periodt. 💖

🎀 OPTIONS 🎀

  • --version — show program's version number and exit. short, sweet, slays.
  • -h, --help — show this help message and exit. she's helping! 🫶
  • -b, --bytes — count fractions in terms of bytes rather than packets/connections. bytes btw. 📏
  • -c, --conn-summaries — input file contains Zeek connection summaries. (yes, the -c from the description. told you.)
  • --conn-version=CONN_VERSION — when used with -c, specify '1' for use with Bro version 1.x connection logs, or '2' for use with Bro 2.x format. '0' tries to guess the format. she'll figure it out, she's smart like that 🧠✨
  • -C, --chema — for packets: include only TCP, ignore when seq==0. no thoughts, just TCP 🔥
  • -e, --external — ignore strictly internal traffic. we don't care about the internal drama 💀
  • -E EXCLUDENETS, --exclude-nets=EXCLUDENETS — excludes CIDRs in file from analysis. not invited to the party 🙈
  • -i ILEN, --intervals=ILEN — create summaries for time intervals of given length (seconds, or use suffix of 'h' for hours, or 'm' for minutes). time slots, but make it fashion ⏰
  • -l LOCALNETS, --local-nets=LOCALNETS — differentiate in/out based on CIDRs in file. who's home and who's visiting 🏠
  • -n TOPX, --topn=TOPX — show top <n>. the ranking. the leaderboard. the moment 👑
  • -p PORTS, --ports=PORTS — include only ports listed in file. VIP list only 💅
  • -P STOREPORTS, --write-ports=STOREPORTS — write top total/incoming/outgoing ports into file. receipts, saved to disk 🧾
  • -r, --resolve-host-names — resolve host names. give those numbers a glow-up ✨
  • -R tag, --R=tag — write output suitable for R into files <tag.*>. for the stats girlies 📊
  • -s FACTOR, --sample-factor=FACTOR — sample factor of input. scale it, bestie
  • -S SAMPLE, --do-sample=SAMPLE — sample input with probability (0.0 < prob < 1.0). a little taste, not the whole meal 🍓
  • -m, --save-mem — do not make memory-expensive statistics. your RAM said please 😭
  • -t, --tcp — include only TCP. TCP only, we're exclusive 🎀
  • -u, --udp — include only UDP. UDP only, equally exclusive 🌈
  • -U MINTIME, --min-time=MINTIME — minimum time in ISO format (e.g. 2005-12-31-23-59-00). nothing before this, ok? ⏳
  • -v, --verbose — show top-n for every interval. she's chatty and we love her 🗣️💖
  • -V MAXTIME, --max-time=MAXTIME — maximum time in ISO format. and nothing after this either 🛑

🦋 AUTHOR 🦋

trace-summary was written by The Zeek Project <info@zeek.org>. legends only. 🫶

and that's the whole page, bestie!! trace-summary, November 2014, straight from the User Commands section — go forth and summarise your traffic, you absolute icon 💜✨

📦 where this page comes from