TRACETOPENDS(1)

💖 TRACETOPENDS 💖

okay so bestie, welcome to tracetopends, a User Commands manual page, and it is literally the gossip column of your network trace 🔥

---

✨ NAME ✨

tracetopends — reports the endpoints that are responsible for the most traffic in a trace 👑

---

🌸 SYNOPSIS 🌸

tracetopends [ -f bpf ] [ -A addrtype ] [ -s ] [ -d ] [ -b ] [ -a ] [ -p
] [ -n topcount ] inputuri [inputuri ...]

---

🦋 DESCRIPTION 🦋

So like, tracetopends reports the number of bytes and packets sent and received by the busiest endpoints observed in the input trace(s). It's giving leaderboard. It's giving who's hogging the bandwidth. 💅

• -f bpf filter — only output packets that match a tcpdump-style bpf filter. Filtered. Curated. As it should be ✨
• -n top count — report the top N endpoints (defaults to 10). Only the top ten get to sit at the cool table 🫶
• -A address type — specifies how an endpoint should be defined. Suitable options are "mac", "v4" and "v6", which will report endpoint stats for each observed MAC address, IPv4 address and IPv6 address respectively. Pick your fighter 🌈
• -s — sort endpoints based on the amount of outgoing traffic (will cancel any previous -d option). This is on by default. She's the main character, no cap 👑
• -d — sort endpoints based on the amount of incoming traffic (will cancel any previous -s option). Inbox energy 📥
• -b — sort endpoints based on the amount of IP traffic (will cancel any previous -a or -p options). This is on by default. The baseline, the blueprint, the moment 💜
• -a — sort endpoints based on the amount of application layer traffic (will cancel any previous -b or -p options). We're going up the stack, bestie 🧚
• -p — sort endpoints based on the amount of packets (will cancel any previous -b or -a options). Counting the little guys, one by one 🍓

lowkey important: those sort options are all cancelling each other. You pick one vibe and you commit. The last one you type wins, periodt 😭

---

🌟 OUTPUT 🌟

Output is written to stdout in columns separated by blank space.

The columns are (in order):

• Endpoint address
• Time last observed
• Packets originating from the endpoint
• Bytes originating from the endpoint (IP header onwards)
• Payload originating from the endpoint (post transport header)
• Packets sent to the endpoint
• Bytes sent to the endpoint (IP header onwards)
• Payload sent to the endpoint (post transport header)

eight columns of pure information, and honestly? she ate 💅

---

🎀 EXAMPLES 🎀

Find the IPv4 addresses that are sending the most traffic.

tracetopends -A v4 -b -s erf:trace.erf.gz

look at her go 🦋

---

💜 LINKS 💜

More details about tracetopends (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

---

⭐ SEE ALSO ⭐

libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1), tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1)

the whole friend group 🫶 go say hi

---

👑 AUTHORS 👑

Shane Alcock <salcock@cs.waikato.ac.nz> — the icon, the legend, the moment 💖

---

and that's the whole page bestie!! this one's from the tracetopends crew over at libtrace, dated September 2011 🌸 ty for reading, mwah 💅✨