TRACESPLIT(1)

💖 TRACESPLIT(1) 💖

okay so bestie, welcome to the tracesplit manual page, section 1 (User Commands) ✨ this is literally the tool that takes your big giant trace and goes snip snip snip into a bunch of lil baby tracefiles 🎀

---

✨ NAME ✨

tracesplit — split traces 🦋

---

🌸 SYNOPSIS 🌸

tracesplit [ -f bpf | --filter=bpf] [ -c count | --count=count] [ -b
bytes | --bytes=bytes] [ -i seconds | --seconds=seconds] [ -s unixtime |
--starttime=unixtime] [ -e unixtime | --endtime=unixtime] [ -m maxfiles
| --maxfiles=maxfiles] [ -S snaplen | --snaplen=snaplen] [ -z level |
--compress-level=level] [ -Z method | --compress-type=method] inputuri
[inputuri ...] outputuri

like yes there are a LOT of flags, don't panic, we're gonna go through every single one together 💅

---

👑 DESCRIPTION 👑

tracesplit splits the given input traces into multiple tracefiles 💖 that's it, that's the whole vibe. one input, many outputs, iconic.

• -f bpf, --filter=bpf — output only packets that match tcpdump style bpf filter 🌈 no cap, if it doesn't match, it doesn't make the cut.
• -c count, --count=count — output count packets per output file. The output file will be named after the basename given in the outputuri with the packet number of the first packet in this file 📦 so like, first packet's number is literally in the filename, iykyk.
• -b bytes, --bytes=bytes — output bytes bytes per file 📏 chunk it by size, periodt.
• -i seconds, --seconds=seconds — start a new tracefile after "seconds" seconds ⏰ time-based splitting, so organized of it.
• -s unixtime, --starttime=unixtime — don't output any packets before unixtime 🙈 early packets stay home.
• -e unixtime, --endtime=unixtime — don't output any packets after unixtime 🚫 late packets also stay home.
• -m maxfiles, --maxfiles=maxfiles — do not create more than "maxfiles" trace files 🛑 bestie there is a LIMIT, respect it.
• -S snaplen, --snaplen=snaplen — Truncate packets to "snaplen" bytes long. The default is collect the entire packet ✂️ so if you don't say anything, you're getting the WHOLE packet, no trimming.
• -z level, --compress-level=level — Compress the data using the specified compression level, ranging from 0 to 9. Higher compression levels tend to result in better compression but require more processing power to compress 💪 bigger number = smaller file but your CPU is gonna be sweating.
• -Z compression-method, --compress-type=method — Compress the data using the specified compression algorithm. Accepted methods are "gzip", "bzip2", "lzo", "xz" or "none". Default value is none unless a compression level is specified, in which case gzip will be used 🗜️ so if you set -z but not -Z, gzip just volunteers itself, main character energy fr fr.

---

🌟 EXAMPLES 🌟

create a 1MB erf trace of port 80 traffic.

tracesplit -z 1 -Z gzip -f 'port 80' -b $[ 1024 * 1024 ]
erf:/traces/bigtrace.gz erf:/traces/port80.gz

look at her go 😭 filtered, size-limited, compressed, and cute. the $[ 1024 * 1024 ] is doing the math for you so you don't have to, we love a self-sufficient queen 🧚

---

🔗 LINKS 🔗

More details about tracesplit (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

(the lore goes deep, bestie, go read it 🫶)

---

🦋 SEE ALSO 🦋

libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1), tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1)

the whole libtrace friend group is here, they're all slaying in their own way 💜

---

💅 AUTHORS 💅

Perry Lorier <perry@cs.waikato.ac.nz> — thank you for your service king 👑

---

and that's the whole page bestie!! no notes, 10/10, go split some traces ✨

tracesplit (libtrace) — January 2011 🎀 mwah, that's the version and date, bye now!! 💖🌸🦋