TRACEUCAST(1)

💖 TRACEUCAST(1) — libtrace edition 💖

Welcome to the User Commands corner of the libtrace manual, bestie 🫶. This is the traceucast(1) page, and yes, it’s giving reliable packet stream main character energy ✨.

🌸 NAME 🌸

traceucast - stream captured packets to a libtrace client

✨ SYNOPSIS ✨

traceucast [ -m <monitor identifier> ] [ -f <filterstring> ] [ -c <client address> ] [ -p <port for beaconing group> ] [ -t <number of threads> ] inputuri

🦋 DESCRIPTION 🦋

Okay so traceucast reads packets from a single live packet source — e.g. an interface or hardware capture card — and then emits those packets to a specified libtrace client program that can process the packets off-site. Iconic, honestly 💅.

This allows the redirection of packets captured on one host to another. The way that works is lowkey magical: capture here, process there 🦋.

Unlike tracemcast, traceucast uses TCP to transfer packets, so the packet stream is reliable and ordered. The downside is that traceucast can only maintain a connection to a single receiving client at a time 😭.

Vibe check: not me being a one-client-at-a-time queen 💀. That’s the tradeoff, bestie.

The streaming protocol is the nDAG protocol, which libtrace supports as an input format, so libtrace programs can natively receive packets from a traceucast instance without any additional modifications. No cap, that’s the whole slay of it, fr fr ✨.

🎀 OPTIONS 🎀

• -m <monitor identifier> — set a unique identifier that will be included in the nDAG header. This is used by the recipient to tell which traceucast instance emitted the packet. iykyk 🎀
• -f <filterstring> — only emit packets that match this BPF filter expression. Filtering? We love a selective queen 🍓.
• -c <address> — transmit captured packets to this client address. The client should be a libtrace program that is using an ndagtcp: input URI. Slay that URI situation 💅.
• -p <port> — send nDAG beacon messages to this port number. Beaconing, but make it cute ✨.
• -t <threads> — sets the number of threads to use for streaming packets. Each thread will produce a separate stream on a unique port. Multi-stream, multi-slaying 👑.

🔗 LINKS 🔗

More details about traceucast (and libtrace) can be found at https://github.com/LibtraceTeam/libtrace/wiki 🌈.

👀 SEE ALSO 👀

• libtrace(3)
• tracesplit(1)
• tracesplit_dir(1)
• tracefilter(1)
• traceconvert(1)
• tracereport(1)
• tracertstats(1)
• tracestats(1)
• tracepktdump(1)
• traceanon(1)
• tracesummary(1)
• tracereplay(1)
• tracediff(1)
• traceends(1)
• tracetopends(1)
• tracemerge(1)
• tracemcast(1)

💜 AUTHORS 💜

Shane Alcock <shane@alcock.co.nz>

---

This lil page is from the traceucast (libtrace) manual, dated Oct 2023, and it lives in section TRACEUCAST(1). Bye bestie, go stream those packets responsibly 💖✨🦋.