rasort -m loss won't work
Wolfgang Barth
wob at swobspace.de
Sun Apr 8 07:54:33 EDT 2007
Hi,
rasort -m loss did not work correctly:
% rasort -m loss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
Proto SrcAddr Dport Loss SrcLoss DstLoss
tcp 172.17.8.0.www 6 0 6
tcp 172.17.14.0.www 8046 20 8026
tcp 172.17.16.0.www 1604 0 1604
tcp 172.17.16.0.https 12 0 12
=> not really sorted ...
% rasort -m sloss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
Proto SrcAddr Dport Loss SrcLoss DstLoss
tcp 172.17.32.0.https 214 122 92
tcp 192.168.50.0.https 142 104 38
tcp 172.17.128.0.https 350 85 265
tcp 172.17.248.0.https 78 40 38
=> ok.
% rasort -m dloss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
Proto SrcAddr Dport Loss SrcLoss DstLoss
tcp 172.17.184.0.www 8924 10 8914
tcp 172.21.40.0.www 8626 8 8618
tcp 172.17.216.0.www 8549 9 8540
tcp 172.17.168.0.www 8125 19 8106
=> ok.
Additional: it would be nice to sort about ploss (sploss, dploss).
Wolfgang
--
<wob (at) swobspace de> * http://www.swobspace.de
More information about the argus
mailing list