rc.37 filter broken?

[carter at qosient.com]

Hey Peter!!
I'll take a look at this over the weekend!!
Could you send me the output of ra() with the -b option, usinf your filter?

Thanks!!

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: Peter Van Epp <vanepp at sfu.ca>
Date: Thu, 1 Feb 2007 09:11:11 
To:argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] rc.37 filter broken?

	This filter works as expected on 2.0.6:

ra -r /usr/local/argus/com_argus.archive/2007/02/01/* -nn host 209.190.24.98 and not host 142.58.195.106

	But doesn't seem to on rc.37 (I haven't upgraded yet):

/usr/local/bin/ra3 -r /archive/argus3/com_argus.archive/2007/001/* -n -- host 209.190.24.98 and not host 142.58.197.106   
   23:59:58.461746             tcp      209.190.24.98.12969     ->     142.58.195.106.80            3        2         1404          120   CON
   00:00:03.212768             tcp      209.190.24.98.12553     ->     142.58.195.106.80            3        4          180         2644   FIN


Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada