racount

[Neil Long]

>Hi
>
>racount on Solaris is underestimating the total bytes, e.g.
>
>for a 1 hour data file
>
>../racount -nr argus.07.06.11:00.gz net xxx.yyy.zzz
>racount: totrcds        101282  rcds      1110  pkts         2779525
>bytes    1927726621
>
>but
>
>../racount -nr argus.07.06.11:00.gz
>racount: totrcds        101282  rcds    101269  pkts       173961940
>bytes    1067804319
>
>i.e. the total bytes for the net is larger than the total for all nets
>
>I increased the format number from 9 to 12 in racount.c just to be sure
>there is not a simple format error. The data types are unisigned long.
>
>Just to confirm this I simply added fields to output the total_src_bytes,
>total_dst_bytes before the grand total ---
>
>../racount -nr argus.07.06.11:00.gz
>racount: totrcds        101282  rcds    101269  pkts       173961940
>bytes    2710310111     bytes     2652461504    bytes     1067804319
>
>so that was 5.1G .....
>
>Anyone got a LART I can borrow?
>
>Cheers
>Neil
>
>


Just for the record - only Compaq Tru64 (Digital Unix) copes with the simple
change
from %9u to %12lu

Solaris, IRIX(32bit Indy), etc needed the summation to be cast to a (long
long) and the use of %12llu

(I guess IRIX on a 64bit system or maybe Solaris on a 64bit system will be
similar to Digital-Unix)

Sigh .... dread to think what you really high bandwidth types end up with
per hour....

Neil