argus-clients alpha testing and ratop()

[Carter Bullard]

Gentle people,
   The ./configure files and make strategies for the 
argus-clients project are working fine for Linux, but some
adjustments were needed for Solaris, so a new version is on
the server.

ftp://qosient.com/dev/argus-2.0/argus-clients-2.0.1.alpha.2.tar.gz

This type of testing is important at this stage, and so if
anyone has any problems with ./configure or making in
general, please send a comment.

Ok, I think I'd like to focus on ratop() for a while.
ratop changed slightly between alpha.1 and alpha.2.

This program is trying to show you the top flows in
an argus data stream.  It is primarily designed for
attaching to an argus server to see what's on top in real-time.
Its modeled after the Unix process top, so it has a similar
look and feel, curses based, type 'q' and it quits,
sorts on the fly, has lots of options, etc.....

A big deal with ratop is that it supports ragator
like aggregation.  Right now, for demonstration purposes,
ratop() has 21 or so internal aggregation strategies, that
you choose using the "D" and "U" keys.

I've got it starting now in a mode so that its
aggregating everything into a single entry, so that if
your looking at a very loaded network, you won't get
blown away at the start.

Finding a strategy that is usable would be nice.  If
anyone has any comments on this area, please send mail.
There is no 'h' support, yet, that should be next.

If the output is too wide, press the 'F' key, this
allows you to choose what fields to display or not to
display.  They act as toggles, so if you hit 'F' and
then 'c', the counts fields go away and or come back,
depending on whether they visible or not.  The options
are (tDIcL) for time, Duration, Indicators, counts, and
Load.  I'll have all the columns in a few days.

If you're doing something and ratop is not doing what you want,
press 'Esc', that may clear things up.

What I'm hoping to do with this process is to get some
opinions on the UI and the tool concept.  So if you get
a chance to play with it and give some comments, that
would be great.  And of course, if you think that "this
complete sucks and is a waste of time", do send it to the
list!!!

Thanks for your attention!

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com