delimited fields

[Carter Bullard]

Hey Russell,
   The reason we fuse the port with the address right now
is so that we end up with the same number of columns regardless
of whether the protocol is TCP/UDP or not.

   We could use something other than '.' between the addr
and the port, so you can still separate the two easily but
still get the same column count (based on the general field
delimiter).  Say a ':' or '_' may work?
  

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 17A
New York, New York  10022

carter at qosient.com
Phone +1 212 813-9426
Fax   +1 212 813-9426


-----Original Message-----
From: owner-argus at lists.andrew.cmu.edu
[mailto:owner-argus at lists.andrew.cmu.edu]On Behalf Of Russell Fulton
Sent: Monday, October 23, 2000 8:52 PM
To: argus at lists.andrew.cmu.edu
Subject: delimited fields


Hi All,
	I have been playing with the delimited fields in ra and have 
turned up a small anomaly.

The labels as printed with -L seems to treat the 'Port's as separate 
fields but the data is still formatted with portnumber attached to the 
IP address with a '.' in a single field.

Logically the port number is part of the address, but from a practical 
point of view I almost always want the IP address and port number in 
separate variable so I would prefer to have them in separate fields.

What do others think?

If we do have them as separate fields then the -L labels should 
explicitly say 'SPort' or 'SrcPort' not just 'Port' as they do now.

CHeers, Russell.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20001024/0471fea3/attachment.html>