TRACEUCAST(1)

traceucast - stream captured packets to a libtrace client

SYNOPSIS
traceucast [ -m <monitor identifier> ] [ -f <filterstring> ] [ -c <client address> ] [ -p <port for beaconing group> ] [ -t <number of threads> ] inputuri

DESCRIPTION
traceucast reads packets from a single live packet source (e.g. an interface or hardware capture card) and then emits those packets to a specified libtrace client program that can process the packets off-site. This allows the redirection of packets captured on one host to another. Unlike tracemcast, traceucast uses TCP to transfer packets, so the packet stream is reliable and ordered. The downside is that traceucast can only maintain a connection to a single receiving client at a time. The streaming protocol is the nDAG protocol, which libtrace supports as an input format, so libtrace programs can natively receive packets from a traceucast instance without any additional modifications.

-m <monitor identifier>
    set a unique identifier that will be included in the nDAG header. This is used by the recipient to tell which traceucast instance emitted the packet.

-f <filterstring>
    only emit packets that match this BPF filter expression.

-c <address>
    transmit captured packets to this client address. The client should be a libtrace program that is using an ndagtcp: input URI.

-p <port>
    send nDAG beacon messages to this port number.

-t <threads>
    sets the number of threads to use for streaming packets. Each thread will produce a separate stream on a unique port.

LINKS
More details about traceucast (and libtrace) can be found at https://github.com/LibtraceTeam/libtrace/wiki

SEE ALSO
libtrace(3), tracesplit(1), tracesplit_dir(1), tracefilter(1), traceconvert(1), tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1), tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1), tracemerge(1), tracemcast(1)

AUTHORS
Shane Alcock <shane@alcock.co.nz>