---
name: "tracestats"
section: "1"
platform: "linux"
package: "libtrace-tools"
version: "3.0.22-0.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://carta.tech/man/tracestats"
---

# tracestats(1)

perform simple analysis on a trace

## NAME

tracestats - perform simple analysis on a trace

## SYNOPSIS

**tracestats** \[ -f \| --filter bpf \]... inputuri...

## DESCRPTION

tracestats reads one or more traces and outputs summaries for each trace of how many packets/bytes match each bpf filter, as well as totals.  If instead of doing this for the entire trace, but to do it for portions then use [tracertstats(1)](/man/tracertstats/1.md) instead.

- **-f** *bpf-filter*

  - **--filter** *bpf-filter*

  Add another bpf filter

## EXAMPLES

```
tracestats --filter 'host sundown' \
	--filter 'port http' \
	--filter 'port ftp or ftp-data' \
	--filter 'port smtp' \
	--filter 'tcp[tcpflags] & tcp-syn!=0' \
	--filter 'not ip' \
	--filter 'ether[0] & 1 == 1' \
	--filter 'icmp[icmptype] == icmp-unreach' \
	erf:/traces/trace1.gz \
	erf:/traces/trace2.gz \
```

## LINKS

More details about tracestats (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

## SEE ALSO

libtrace(3), [tracemerge(1)](/man/tracemerge/1.md), [tracefilter(1)](/man/tracefilter/1.md), [traceconvert(1)](/man/traceconvert/1.md), [tracesplit(1)](/man/tracesplit/1.md),  [tracesplit\_dir(1)](/man/tracesplit_dir/1.md), [tracereport(1)](/man/tracereport/1.md), [tracertstats(1)](/man/tracertstats/1.md), [tracepktdump(1)](/man/tracepktdump/1.md),  [traceanon(1)](/man/traceanon/1.md), [tracesummary(1)](/man/tracesummary/1.md), [tracereplay(1)](/man/tracereplay/1.md), [tracediff(1)](/man/tracediff/1.md), [traceends(1)](/man/traceends/1.md), [tracetopends(1)](/man/tracetopends/1.md)

## AUTHORS

Perry Lorier \<perry@cs.waikato.ac.nz\>