rasort issues

[Carter Bullard]

Gentle people,
   Now's the time to get your opinion in.  So don't be shy at all!!!!!
So this is what we have:

   rasort [-s [sorttag] [-s [sorttag]] ...] ....

Ok so you can have up to 32 sort directives.
We will sort on the first in the list, if there are ties,
then we will sort base on the 2nd sorttag, and if that
generates a tie, we'll sort based on the 3rd string, etc..

The sort tags we currently have are:
char *RaSortKeyWords[MAX_SORT_ALG_TYPES] = {
   "startime",
   "lasttime",
   "duration",
   "srcaddr",
   "dstaddr",
   "proto",
   "sport",
   "dport",
   "stos",
   "dtos",
   "sttl",
   "dttl",
   "bytes",
   "srcbytes",
   "dstbytes",
   "packets",
   "srcpackets",
   "dstpackets",
};

So what does this let you do? Well for Mark P. he can do his
ramon -M TopN and have it be TopN for any of the fields.

   ramon -M TopN -r file -w - | rasort -r - -s dstbytes -N 10

will give the Top 10 address based on receiving bytes.

   ramon -M TopN -r file -w - | rasort -r - -s srcpackets -N 20

will give the Top 20 addresses based on sending packets.

   ramon -M TopN -r file -w - | rasort -r - -s ttl -s bytes -N 20

This will give you Top 20 biggest load generators in order
of distance, from closest to farthest in hops.


Now the question.  What's the best way to indicate that we want
a reverse order sort?  We should be able to indicate it on
each sorttag specified on the line, so what, "-s ^sorttag"? 

I would love some opinion!

Carter


Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 17A
New York, New York  10022

carter at qosient.com
Phone +1 212 813-9426
Fax   +1 212 813-9426
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20001025/337fc021/attachment.html>