rasort -m loss won't work

Wolfgang Barth wob at swobspace.de
Sun Apr 8 07:54:33 EDT 2007


Hi,

rasort -m loss did not work correctly:

% rasort -m loss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
  Proto      SrcAddr        Dport       Loss    SrcLoss    DstLoss 
    tcp         172.17.8.0.www             6          0          6
    tcp        172.17.14.0.www          8046         20       8026
    tcp        172.17.16.0.www          1604          0       1604
    tcp        172.17.16.0.https          12          0         12

=> not really sorted ...

% rasort -m sloss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
  Proto      SrcAddr        Dport       Loss    SrcLoss    DstLoss 
    tcp        172.17.32.0.https         214        122         92
    tcp       192.168.50.0.https         142        104         38
    tcp       172.17.128.0.https         350         85        265
    tcp       172.17.248.0.https          78         40         38

=> ok.

% rasort -m dloss -r /var/tmp/argus.x -s proto saddr dport loss sloss dloss | head -5
  Proto      SrcAddr        Dport       Loss    SrcLoss    DstLoss 
    tcp       172.17.184.0.www          8924         10       8914
    tcp        172.21.40.0.www          8626          8       8618
    tcp       172.17.216.0.www          8549          9       8540
    tcp       172.17.168.0.www          8125         19       8106

=> ok.

Additional: it would be nice to sort about ploss (sploss, dploss).

Wolfgang
-- 
<wob (at) swobspace de> * http://www.swobspace.de



More information about the argus mailing list