port numbers missing from argus records
Peter Van Epp
vanepp at sfu.ca
Tue Apr 19 22:03:50 EDT 2005
> my problem is not that the port number is null it is missing entirely
> from the delimited output. At the moment I only seem to be dropping
> source ports so I suppose I could check how many tokens I get from ra
> and set $sport to '' if there are less than expected but what happens if
> it starts dropping dest ports too?
> I'll have a poke at the code this afternoon and see if I can figure out
> how ra manages to not output the port number.
Ah, the previous bug which begats the one this fix is for. \t is
broken (as I recall the code \t isn't a valid delimiter I think it really
wants cntrl-I in there) but by that time I had made this change and didn't
worry about it.
This works for me (at which point the port number becomes blank on 65565 port
numbers and thus the other fix).
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
More information about the argus