.TH TRACESTATS "1" "October 2005" "tracestats (libtrace)" "User Commands"
.SH NAME
tracestats \- perform simple analysis on a trace
.SH SYNOPSIS
.B tracestats 
[ -f | --filter bpf ]... inputuri...
.SH DESCRPTION
tracestats reads one or more traces and outputs summaries for each trace of
how many packets/bytes match each bpf filter, as well as totals.  If instead
of doing this for the entire trace, but to do it for portions then use
tracertstats(1) instead.
.TP
.PD 0
.BI \-f " bpf-filter"
.TP
.PD
.BI \-\^\-filter " bpf-filter"
Add another bpf filter

.SH EXAMPLES
.nf
tracestats \-\^\-filter 'host sundown' \\
	\-\^\-filter 'port http' \\
	\-\^\-filter 'port ftp or ftp-data' \\
	\-\^\-filter 'port smtp' \\
	\-\^\-filter 'tcp[tcpflags] & tcp-syn!=0' \\
	\-\^\-filter 'not ip' \\
	\-\^\-filter 'ether[0] & 1 == 1' \\
	\-\^\-filter 'icmp[icmptype] == icmp-unreach' \\
	erf:/traces/trace1.gz \\
	erf:/traces/trace2.gz \\
.fi

.SH LINKS
More details about tracestats (and libtrace) can be found at
http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

.SH SEE ALSO
libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit(1), 
tracesplit_dir(1), tracereport(1), tracertstats(1), tracepktdump(1), 
traceanon(1), tracesummary(1), tracereplay(1), tracediff(1),
traceends(1), tracetopends(1)

.SH AUTHORS
Perry Lorier <perry@cs.waikato.ac.nz>