Man page or keyword search:   man All Sections 1 - General Commands 2 - System Calls 3 - Subroutines, Functions 4 - Special Files 5 - File Formats 6 - Games and Screensavers 7 - Macros and Conventions 8 - Maintenence Commands 9 - Kernel Interface New Commands Server 4.4BSD AIX Alpinelinux Archlinux Aros BSDOS BSDi Bifrost CentOS Cygwin Darwin Debian DigitalUNIX DragonFly ElementaryOS Fedora FreeBSD Gentoo GhostBSD HP-UX Haiku Hurd IRIX Inferno JazzOS Kali Knoppix LinuxMint MacOSX Mageia Mandriva Manjaro Minix MirBSD NeXTSTEP NetBSD OPENSTEP OSF1 OpenBSD OpenDarwin OpenIndiana OpenMandriva OpenServer OpenSuSE OpenVMS Oracle PC-BSD Peanut Pidora Plan9 QNX Raspbian RedHat Scientific Slackware SmartOS Solaris SuSE SunOS Syllable Tru64 UNIXv7 Ubuntu Ultrix UnixWare Xenix YellowDog aLinux   44335 pages apropos Keyword Search (all sections) Output format html ascii pdf view pdf save postscript

TRACETOPENDS(1)			 User Commands		       TRACETOPENDS(1)

NAME
       tracetopends  - reports the endpoints that are responsible for the most
       traffic in a trace

SYNOPSIS
       tracetopends [ -f bpf ] [ -A addrtype ] [ -s ] [ -d ] [ -b ] [ -a  ]  [
       -p ] [ -n topcount ] inputuri [inputuri ...]

DESCRIPTION
       tracetopends  reports the number of bytes and packets sent and received
       by the busiest endpoints observed in the input trace(s).

       -f bpf filter
	      Output only packets that match tcpdump style bpf filter.

       -n top count
	      Report the top N endpoints (defaults to 10).

       -A address type
	      Specifies how an endpoint should be  defined.  Suitable  options
	      are  "mac",  "v4"	 and "v6" which will report endpoint stats for
	      each observed MAC address, IPv4 address and IPv6 address respec‐
	      tively.

       -s     Sort  endpoints  based  on  the amount of outgoing traffic (will
	      cancel any previous -d option. This is on by default.

       -d     Sort endpoints based on the amount  of  incoming	traffic	 (will
	      cancel any previous -s option.

       -b     Sort  endpoints  based  on the amount of IP traffic (will cancel
	      any previous -a or -p options. This is on by default.

       -a     Sort endpoints based on the amount of application layer  traffic
	      (will cancel any previous -b or -p options.

       -p     Sort  endpoints  based on the amount of packets (will cancel any
	      previous -b or -a options.

OUTPUT
       Output is written to stdout in columns separated by blank space.

       The columns are (in order):
	* Endpoint address
	* Time last observed
	* Packets originating from the endpoint
	* Bytes originating from the endpoint (IP header onwards)
	* Payload originating from the endpoint (post transport header)
	* Packets sent to the endpoint
	* Bytes sent to the endpoint (IP header onwards)
	* Payload sent to the endpoint (post transport header)

EXAMPLES
       Find the IPv4 addresses that are sending the most traffic.
       tracetopends -A v4 -b -s erf:trace.erf.gz

LINKS
       More  details  about  tracetopends  (and	 libtrace)  can	 be  found  at
       http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

SEE ALSO
       libtrace(3),  tracemerge(1),  tracefilter(1),  traceconvert(1), traces‐
       plit_dir(1), tracereport(1), tracertstats(1), tracestats(1),  tracepkt‐
       dump(1),	 traceanon(1),	tracesummary(1), tracereplay(1), tracediff(1),
       traceends(1)

AUTHORS
       Shane Alcock <salcock@cs.waikato.ac.nz>

tracetopends (libtrace)		September 2011		       TRACETOPENDS(1)

Vote for polarhome