TRACEMCAST(1)

🎀 NAME 🎀

okay bestie, welcome to the tracemcast(1) page — it's filed under User Commands, and it's literally all about how to multicast captured packets on an interface. That's the one-line vibe, but trust me, this little tool is a packet-sharing icon. 💅✨

✨ SYNOPSIS ✨

tracemcast [ -m <monitor identifier> ] [ -f <filterstring> ] [ -g
       <multicast group address> ] [ -p <port for beaconing group> ] [ -s
       <source address> ] [ -t <number of threads> ] [ -M <mtu> ] inputuri

🦋 DESCRIPTION 🦋

okay so tracemcast reads packets from a single live packet source (like an interface or a hardware capture card), and then it emits those packets to a multicast group that interested clients can join to receive an independent feed of the captured packets. it's giving packet democracy 🫶.

This is iconic because it lets you share a capture source that would normally only allow one program to read from it at a time. No cap, that's a serious glow-up for your capture setup. 🔥

The multicasting protocol is the nDAG protocol, and libtrace supports it as an input format, so libtrace programs can natively receive packets from a tracemcast group without any additional modifications. periodt ✨

💅 the flags, one by one 💅

• -m <monitor identifier> — set a unique identifier that will be included in the nDAG header. This is used by the recipient to tell which multicast sender emitted the packet. iykyk.
• -f <filterstring> — only emit packets that match this BPF filter expression. Filtered and fabulous, bestie. 🎀
• -g <address> — emit packets to this multicast group address (e.g. 224.0.0.1). group chat, but make it packets.
• -p <port> — send nDAG beacon messages to this port number. Beacon vibes ✨.
• -s <address> — use the interface that owns this IP address to multicast packets. Pick the interface by its IP, main character interface energy.
• -t <threads> — sets the number of threads to use for capturing and multicasting packets. Each thread will produce a separate multicast stream on a unique port. multithreaded baddie behavior 🔥.
• -M <bytes> — do not create any nDAG multicast messages larger than this number of bytes. Don't forget to allow for additional encapsulation (e.g. Ethernet, IP, UDP) when determining this value. important caveat, bestie — account for the extra wrapping or your math will be off 😭.

🔗 LINKS 🔗

More details about tracemcast (and libtrace) can be found at https://github.com/LibtraceTeam/libtrace/wiki. go read, it's cute.

👀 SEE ALSO 👀

• libtrace(3)
• tracesplit(1)
• tracesplit_dir(1)
• tracefilter(1)
• traceconvert(1)
• tracereport(1)
• tracertstats(1)
• tracestats(1)
• tracepktdump(1)
• traceanon(1)
• tracesummary(1)
• tracereplay(1)
• tracediff(1)
• traceends(1)
• tracetopends(1)
• tracemerge(1)
• traceucast(1)

💖 AUTHORS 💖

Shane Alcock <salcock@waikato.ac.nz> — the author, the icon, the legend. 🫶

and that's the page, bestie! this was tracemcast (libtrace) from Feb 2020, signing off with a cute little footer moment instead of the boring footer line. 💅✨