racount updates?

[CS Lee]

Carter,

Thanks a lot, it works and apparently it makes sense where racluster should
aggregate the flows and with -m proto as key objects it able to manipulate
and generate the overall statistic for different protocols, it does make
sense and my silly of not thinking of it.

Cheers, and would like to see the racount man page updates soon.

On 10/17/06, carter at qosient.com <carter at qosient.com> wrote:
>
> Hey CS,
> racluster is the preferred way to do this now:
>
>    racluster -m proto -r file
>
> And use the -s option to build the output format style that your
> interested in.  racount didn't have this flexibility.
>
>    '-s stime dur trans pkts bytes'
>
> whatever.  Racount has been modified to add other types of objects, such
> as address family counting,  "-A" or is it "-a".  I'll update the man page
> soon.
>
> Sorry for any inconvenience.
>
> Carter
>
> Carter Bullard
> QoSient LLC
> 150 E. 57th Street Suite 12D
> New York, New York 10022
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax
>
> -----Original Message-----
> From: "CS Lee" <geek00l at gmail.com>
> Date: Tue, 17 Oct 2006 13:58:39
> To:argus-info at lists.andrew.cmu.edu
> Subject: [ARGUS] racount updates?
>
> Hey all,
>
> I would like to use racount to generate the general overall statistic
> based on protocol, while in man page it says that racount -M proto will
> dothejob,howeverformeitjustdoesn'
> tworkanditapparentlysumupalltheprotocolsandshowtheresultofeverything.ThenItryto us the common method - filter expression,
>
> racount -r data.argus - tcp
> racount -r data.argus - icmp
> racount -r data.argus - udp
>
> It shows correctly which is what I want, I try to check on racount -h and
> apparently it doesn't show anything about -M either, thus I'm wondering any
> modes are supported by racount because it may confuse people who use it for
> the first time or do we need an update for the man page :)
>
> Cheers all :)
>
> --
> Best Regards,
>
> CS Lee<geekooL[at]gmail.com>




-- 
Best Regards,

CS Lee<geekooL[at]gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20061017/aed95bc7/attachment.html>