TRACE-SUMMARY(1) User Commands TRACE-SUMMARY(1)

# [NAME](#NAME)

trace-summary - generate network traffic summaries

# [SYNOPSIS](#SYNOPSIS)

**trace-summary** \[*options*] \[*input-file*]

# [DESCRIPTION](#DESCRIPTION)

**trace-summary** generates break-downs of network traffic, including lists of the top hosts, protocols, ports, etc. Optionally, it can generate output separately for incoming vs. outgoing traffic, per subnet, and per time-interval.

Per default, it assumes the *input-file* to be a libpcap trace file. However, if it is a Zeek connection log, use **-c**. If *input-file* is not given, the script reads from stdin. It writes its output to stdout.

# [OPTIONS](#OPTIONS)

[**--version**](#version)

show program's version number and exit

[**-h**, **--help**](#h)

show this help message and exit

[**-b**, **--bytes**](#b)

count fractions in terms of bytes rather than packets/connections

[**-c**, **--conn-summaries**](#c)

input file contains Zeek connection summaries

[**--conn-version**=*CONN\_VERSION*](#conn)

when used with **-c**, specify '1' for use with Bro version 1.x connection logs, or '2' for use with Bro 2.x format. '0' tries to guess the format

[**-C**, **--chema**](#C)

for packets: include only TCP, ignore when seq==0

[**-e**, **--external**](#e)

ignore strictly internal traffic

[**-E** *EXCLUDENETS*, **--exclude-nets**=*EXCLUDENETS*](#E)

excludes CIDRs in file from analysis

[**-i** *ILEN*, **--intervals**=*ILEN*](#i)

create summaries for time intervals of given length (seconds, or use suffix of 'h' for hours, or 'm' for minutes)

[**-l** *LOCALNETS*, **--local-nets**=*LOCALNETS*](#l)

differentiate in/out based on CIDRs in file

[**-n** *TOPX*, **--topn**=*TOPX*](#n)

show top <n>

[**-p** *PORTS*, **--ports**=*PORTS*](#p)

include only ports listed in file

[**-P** *STOREPORTS*, **--write-ports**=*STOREPORTS*](#P)

write top total/incoming/outgoing ports into file

[**-r**, **--resolve-host-names**](#r)

resolve host names

[**-R** *tag*, **--R**=*tag*](#R)

write output suitable for R into files <tag.\*>

[**-s** *FACTOR*, **--sample-factor**=*FACTOR*](#s)

sample factor of input

[**-S** *SAMPLE*, **--do-sample**=*SAMPLE*](#S)

sample input with probability (0.0 < prob < 1.0)

[**-m**, **--save-mem**](#m)

do not make memory-expensive statistics

[**-t**, **--tcp**](#t)

include only TCP

[**-u**, **--udp**](#u)

include only UDP

[**-U** *MINTIME*, **--min-time**=*MINTIME*](#U)

minimum time in ISO format (e.g. 2005-12-31-23-59-00)

[**-v**, **--verbose**](#v)

show top-n for every interval

[**-V** *MAXTIME*, **--max-time**=*MAXTIME*](#V)

maximum time in ISO format

# [AUTHOR](#AUTHOR)

**trace-summary** was written by The Zeek Project <info@zeek.org>.

November 2014 trace-summary

---

Document: trace-summary(1) from zeek-fips 9.0.0-r1 (Chainguard OS)