TRACEDIFF(1)

NAME
tracediff - find and print differences between two traces

SYNOPSIS
tracediff [ -m maxdiff -a traceA-diff.pcap -b traceB-diff.pcap ] firsturi seconduri

DESCRIPTION
tracediff compares two trace files and prints the details of packets that differ to standard output. This is useful for finding packets that are present in one trace but not another or for finding conversion or snapping errors.

-m maxdiff
    stop processing after displaying 'maxdiff' differences -w windowsize buffer this number of packets from each trace to scan ahead for possible matches

-a traceA-diff.pcap
    Write traceA differences to a file

-b traceB-diff.pcap
    Write traceB differences to a file

EXAMPLES
tracediff -m 10 erf:/traces/orig.erf.gz pcapfile:/traces/convert.pcap.gz
tracediff -m 10 -w 25 -a pcap:orig-diff.pcap -b pcap:convert-diff.pcap erf:/traces/orig.erf.gz pcapfile:/traces/convert.pcap.gz

BUGS
Not exactly a bug, but the contents of the framing headers (i.e. the PCAP or ERF encapsulation) are not compared.

LINKS
More details about tracediff (and libtrace) can be found at https://github.com/LibtraceTeam/libtrace/wiki

SEE ALSO
libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracestats(1), tracesummary(1), tracertstats(1), tracesplit(1), tracesplit_dir(1), tracereport(1), tracepktdump(1), traceanon(1), tracereplay(1), traceends(1), tracetopends(1)

AUTHORS
Shane Alcock <salcock@waikato.ac.nz>, Jacob van Walraven <jwalrave@waikato.ac.nz>