-
Notifications
You must be signed in to change notification settings - Fork 51
tracepktdump
tracepktdump is a libtrace tool that can display packets in a human-readable format. It can be considered analogous to the packet parsing functionality of tcpdump, but with a more user-friendly output format.
tracepktdump [ -f exp | --filter=exp ] [ -c num | --count=num ] inputuri ...
-f, --filter
Output only packets that match the bpf filter expression. See the manpage for tcpdump(8) for the syntax of the bpf filter expression.
-c, --count
Stop after displaying num packets.
Examine packets from a particular flow:
tracepktdump -f "host 192.168.2.110 and host 192.168.2.112 and tcp port 25 and tcp port 5662" erf:trace.erf.gz
tracepktdump uses the libpacketdump library which can parse and neatly display the contents of many common packet headers, including Ethernet, IP, TCP, UDP, ICMP and many others.
tracepktdump replaces the tracedump tool that was present in older versions of libtrace.