racount

[Neil Long]

Hi

racount on Solaris is underestimating the total bytes, e.g.

for a 1 hour data file

../racount -nr argus.07.06.11:00.gz net xxx.yyy.zzz
racount: totrcds        101282  rcds      1110  pkts         2779525
bytes    1927726621

but

../racount -nr argus.07.06.11:00.gz
racount: totrcds        101282  rcds    101269  pkts       173961940
bytes    1067804319

i.e. the total bytes for the net is larger than the total for all nets

I increased the format number from 9 to 12 in racount.c just to be sure
there is not a simple format error. The data types are unisigned long.

Just to confirm this I simply added fields to output the total_src_bytes,
total_dst_bytes before the grand total ---

../racount -nr argus.07.06.11:00.gz
racount: totrcds        101282  rcds    101269  pkts       173961940
bytes    2710310111     bytes     2652461504    bytes     1067804319

so that was 5.1G .....

Anyone got a LART I can borrow?

Cheers
Neil