Ragator config file questions

Wozz wozz+argus at wookie.net
Tue Sep 25 15:25:17 EDT 2001


On Tue, Sep 25, 2001 at 03:20:03PM -0400, Carter Bullard wrote:
> Ohhh, and I just realized one other thing,
> your Model definitions are not preserving
> the proto field.  You should make this mod
> 
> Model   201     0.0.0.0 255.255.255.255 yes     no      yes
> Model   202     0.0.0.0 255.255.255.255 yes     no      yes
> Model   203     0.0.0.0 255.255.255.255 yes     no      yes
> 

Nope, neither of those seemed to fix it.  Another thing I've noticed is
that records with destinations outside my network are getting reported too:

25 Sep 01 14:53:47    tcp    a.b.c.18.35958  ->     209.125.127.5.25
FIN

Am I misunderstanding something, or shoudl that not be reported, since I'm
asking only for destination's on my network (209.125.127.5 is not on my
network)



More information about the argus mailing list