> ## Documentation Index > Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # filetrace transfers: transfer records and unattributed bytes > Reference for filetrace transfers: transfer records with their IDs, including sent bytes that no file accounts for, every option, examples and exit codes. `filetrace transfers` lists transfer records, most recently active first, with the ID of each. Unlike [`files`](https://filetrace.mintlify.site/cli/files), it also lists the bytes a socket sent that no file accounts for, so the rows add up to everything the processes sent. ## Usage ```bash theme={null} filetrace transfers [options] ``` ## What it shows ```bash theme={null} sudo filetrace transfers ``` ```text theme={null} ID PROCESS FILE REMOTE BYTES METHOD CONFIDENCE tr_3 file-server /srv/export/media/files/stream.bin 127.0.0.1:51871 15.5 MB sendfile EXACT tr_s1001 metrics-daemon unknown 192.168.65.1:25374 473 B - UNKNOWN tr_se file-server unknown 127.0.0.1:45789 48.8 KB - UNKNOWN tr_sd file-server unknown 127.0.0.1:49084 6 B - UNKNOWN tr_sc file-server unknown 127.0.0.1:40477 195 KB - UNKNOWN tr_2 file-server /srv/export/media/files/customers.csv 127.0.0.1:52535 11.4 MB read-write INFERRED tr_4 file-server /srv/export/media/files/backup.tar.gz [::1]:46399 7.63 MB sendfile EXACT tr_1 file-server /srv/export/media/files/video.mp4 127.0.0.1:34477 47.7 MB sendfile EXACT Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` | Column | Meaning | | - | - | | ID | The transfer ID | | PROCESS | The name of the process that sent the bytes | | FILE | The file's path, or `unknown` for bytes that no file accounts for | | REMOTE | The remote address and port of the socket | | BYTES | What the socket accepted | | METHOD | `sendfile`, `read-write`, or `-` for unattributed bytes | | CONFIDENCE | `EXACT`, `INFERRED` or `UNKNOWN`; a `*` after it marks a transfer during which events were lost | A transfer record with a file is one file sent by one process on one socket, and its ID is `tr_` followed by a hexadecimal number. A row with FILE `unknown` holds what one socket sent beyond the bytes attributed to files; its ID is `tr_s` followed by the socket ID in hexadecimal (`tr_s1001` is socket 4097). Both kinds of ID appear as `transfer_id` in machine-readable output, and `--format quiet` prints one ID per row. Unattributed rows are left out when a filter can only match files: `--path`, `--path-regex`, `--min-size`, `--deleted`, `--method`, and a `--confidence` other than `unknown` or `all`. ## Options **--deleted** `boolean` Only files that no longer have a directory entry. **--pid** `number` Only this process. **--process** `string` Only processes with this name. `*` matches any run of characters. Alias: `--name`. **--user** `string` Only processes of this user, by name or numeric ID. **--cgroup** `string` Only processes in this cgroup, by numeric ID or cgroup directory. **--namespace** `number` Only processes in this network, PID or mount namespace, given as the inode number that `ls -Li /proc//ns` shows. **--path** `string` Only this file. `*` matches any run of characters, `/` included. Alias: `--file`. **--path-regex** `string` Only files whose path matches this POSIX extended regular expression. **--min-size** `string` Only files at least this large, such as `100MB`. **--remote** `string` Only this remote address or CIDR network. **--local** `string` Only this local address or CIDR network. **--port** `number` Only this local or remote port. **--protocol** `string` (default: all) Only this protocol: `tcp`, `udp` or `all`. **--method** `string` `sendfile` or `read-write`. `splice`, `mmap` and `io_uring` are accepted but not observed by this build; with them the command exits with 5 instead of printing an empty list. **--confidence** `string` `exact`, `strong`, `inferred`, `unknown` or `all`. **--min-bytes** `string` At least this many bytes sent, such as `1KB`, `100MB` or `1GB`. **--active** `boolean` Only records still in progress: updated within the last 5 seconds. **--completed** `boolean` Only records that are no longer in progress. **--since** `string` Only records active at or after this time: a duration such as `10m`, `1h` or `7d`, or an RFC 3339 timestamp. **--until** `string` Only records that started at or before this time. **--sort** `string` `bytes`, `time`, `pid`, `rate`, `duration`, `process` or `file`. Without it, the most recently active come first. **--resolve-hostnames** `boolean` Show remote addresses by host name where a reverse DNS lookup finds one. The lookups tell the DNS resolver which addresses are being looked at. **--limit** `number` Show at most this many rows. **--format** `string` (default: table) `table`, `json`, `jsonl`, `csv` or `quiet`. Quiet prints one transfer ID per row. **--json** `boolean` Short for `--format json`. **--jsonl** `boolean` Short for `--format jsonl`. **--output** `string` Write to this file instead of standard output. Byte counts cover a record's whole observed lifetime; `--since` and `--until` select which records are listed. See [filters](https://filetrace.mintlify.site/cli/filters.md) and [output formats](https://filetrace.mintlify.site/cli/output-formats.md). ## Examples ```bash theme={null} filetrace transfers --active filetrace transfers --remote 203.0.113.42 --min-bytes 1GB filetrace transfers --confidence unknown --since 30m ``` Only the bytes that no file accounts for: ```bash theme={null} sudo filetrace transfers --confidence unknown ``` ```text theme={null} ID PROCESS FILE REMOTE BYTES METHOD CONFIDENCE tr_s1001 metrics-daemon unknown 192.168.65.1:25374 473 B - UNKNOWN tr_se file-server unknown 127.0.0.1:45789 48.8 KB - UNKNOWN tr_sd file-server unknown 127.0.0.1:49084 6 B - UNKNOWN tr_sc file-server unknown 127.0.0.1:40477 195 KB - UNKNOWN Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` In JSON, a record with a file has `"event":"file_transfer"`. Unattributed bytes have `"event":"network_transfer"`, no `file` object, and no method, operations or evidence: ```bash theme={null} sudo filetrace transfers --json --limit 2 ``` ```json theme={null} [ {"event":"file_transfer","transfer_id":"tr_3","timestamp":"2026-11-11T20:07:59.514Z","host":"web-01","platform":"linux","process":{"pid":1024,"ppid":772,"name":"file-server","executable":"/usr/local/bin/file-server"},"file":{"path":"/srv/export/media/files/stream.bin","inode":626330,"device":63,"size":40000000,"owner":"root","filesystem":"overlay","deleted":false},"network":{"protocol":"tcp","socket_id":16,"local_ip":"127.0.0.1","local_port":41814,"remote_ip":"127.0.0.1","remote_port":51871},"transfer":{"method":"sendfile","bytes_sent":16250000,"bytes_per_second":4239224,"operations":65,"started":"2026-11-11T20:07:56.193Z","duration_ms":3320,"state":"active","confidence":"exact","evidence":["direct_file_to_socket_transfer","file_identity","socket_identity","remote_endpoint"],"incomplete":false}}, {"event":"network_transfer","transfer_id":"tr_s1001","timestamp":"2026-11-11T20:07:56.180Z","host":"web-01","platform":"linux","process":{"pid":152,"ppid":1,"name":"metrics-daemon","executable":"/metrics-daemon"},"network":{"protocol":"tcp","socket_id":4097,"local_ip":"192.168.65.7","local_port":2376,"remote_ip":"192.168.65.1","remote_port":25374},"transfer":{"bytes_sent":473,"bytes_per_second":0,"started":"2026-11-11T20:07:56.063Z","duration_ms":116,"state":"active","confidence":"unknown","incomplete":false}} ] ``` ## Exit codes | Code | Meaning | | - | - | | 0 | Success | | 1 | General error | | 2 | Invalid arguments, including an invalid `--path-regex` | | 3 | Permission denied: the agent socket is not accessible to this user | | 4 | No agent is running | | 5 | Unsupported platform, or a `--method` this build does not observe | | 6 | The configuration file cannot be read or is invalid | | 9 | Partial results: events were lost in the queried time range | ## Related pages * [Records and identifiers](https://filetrace.mintlify.site/concepts/data-model.md) explains transfer records and their IDs. * [File attribution and confidence](https://filetrace.mintlify.site/concepts/attribution.md) explains why bytes can stay unattributed. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.