ramon -M HostP

[Carter Bullard]

Hey Andrew,
No problem, you're just jumping up the stack rather than
moving up it ;o)  So, you're really interested in
host/proto/dport.   Lets call it HostSvc and change
the name of HostP to HostProto, to remove any ambiguity.
I'll have this new approach in the next release, which
should be tonight or tomorrow.

Carter



> -----Original Message-----
> From: owner-argus-info at lists.andrew.cmu.edu
> [mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of
> Andrew Pollock
> Sent: Tuesday, September 02, 2003 2:28 AM
> To: argus-info at lists.andrew.cmu.edu
> Subject: ramon -M HostP
>
>
> Hi Carter,
>
> Hope you had a nice vacation.
>
> I've only just gotten around to playing with the ramon -M
> HostP option you
> put in (and I'm currently playing with 2.0.6.beta.41 on this
> particular
> box).
>
> I think you've interpretted "protocol" as "ip protocol"
> whereas I've been
> meaning "TCP or UDP protocol", so I'm getting a lovely breakdown that
> shows mostly TCP traffic. I'm interested in working out how
> much of the
> traffic total generated from running an "ramon -M TopN |
> racount" type
> thing is HTTP, SMTP etc etc.
>
> Sorry if I wasn't clear on this in the first place, or am I
> just driving
> this new option wrong?
>
> regards
>
> Andrew
>