racount

[Peter Van Epp]

> i.e. the total bytes for the net is larger than the total for all nets
> 
> I increased the format number from 9 to 12 in racount.c just to be sure
> there is not a simple format error. The data types are unisigned long.
> 
> Just to confirm this I simply added fields to output the total_src_bytes,
> total_dst_bytes before the grand total ---
> 
> ../racount -nr argus.07.06.11:00.gz
> racount: totrcds        101282  rcds    101269  pkts       173961940
> bytes    2710310111     bytes     2652461504    bytes     1067804319
> 
> so that was 5.1G .....

	And if a long is 32 bits as is standard (although perhaps not on one
of the 64 bit machines), you just overflowed, because 32 bits is around 4 gigs.
Which would leave you about a gig and a half after the over flow as you are
seeing. I get around this by feeding the raw data in to perl which happily does 
multiprecision something under the covers and keeps on chugging up to the 
60 to 80 gigabyte level (I ran a test once to see if it had problems while
I was chasing count descrepincies, I think I was up in the 100s of gigs
without problem). That is perhaps one good reason for at least some thought
of a perl interface from the data as Russell suggested (that and indexing
arrays by almost anything ...) because it protects the unwary (such as me).
One of the perl scripts that I posted long ago should do verify this for 
you if you feed it the raw ra data.

> 
> Anyone got a LART I can borrow?

	If I knew what a LART was I might know if I have one  ...
> 
> Cheers
> Neil
> 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada