What does ramon (TopN mode) actually do?

[Peter Van Epp]

<snip>
> 
> So are you saying that it's impossible (i.e. it's mutually exclusive) to
> take a total from the "similar to an interface counter" (-M TopN) mode and
> break that total down by protocol (-M Svc/big call to ragator/however) and
> actually have it agree with the TopN total?

	If it can't be done with the tools (and it sounds like it may not be)
it likely can be done with a perl script and ra output. The problem seems to
be differring interpretations of source and destination between the two tools.
ra gives perl a common view (the same as one or the other of the tools) but
adds all the detail broken out so that you can sort multiple ways if you like
(I do it all the time) off the same data by selecting what details you want
to sort on (hieractically if you wish, i.e. my usual is total traffic count
by IP in reverse numeric order so large traffic comsumers are first followed
by a breakdown by traffic by source IP and dst port number with common service
ports only by dst port number (because other than total volume they aren't
interesting usually). 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada