tracediff

tracediff reports differences in packets between two trace files.

Usage

tracediff [ -m maxdiff ] firstURI secondURI

Options

-m maxdiff Stop processing after displaying maxdiff different packets

Applications

Report the first 10 differences between an original ERF trace and the converted PCAP version:

    tracediff -m 10 erf:orig.erf.gz pcapfile:convert.pcap.gz

Notes

• The contents of the framing headers, e.g. PCAP or ERF encapsulation, are not compared.
• This tool is primarily intended to verify the integrity of traces or test if two traces are the same. Running tracediff against two entirely different traces will create a LOT of output!