What does ramon (TopN mode) actually do?

[Andrew Pollock]

Carter,

I think you've helped demystify things a bit for me. Thanks very much.

One question:

On Thu, Jun 26, 2003 at 11:31:32AM -0400, Carter Bullard wrote:
> 
> The total_pkts and total_bytes should agree, but not
> the src and dst counters.  That is because "ramon -M topn"
> redefines the source and destination relative to the address,
> which is similar to an interface counter.  With
> "ramon -M svc", the source and destination are defined
> relative to the service, so there is no modification from
> the original argus data.  Comparing TopN data with Svc data
> from the perspective of source and destination is definitely
> an apple/orange comparison.

So are you saying that it's impossible (i.e. it's mutually exclusive) to
take a total from the "similar to an interface counter" (-M TopN) mode and
break that total down by protocol (-M Svc/big call to ragator/however) and
actually have it agree with the TopN total?

:-(

Andrew