Flow timeout value

[CS Lee]

Carter,

I have just noticed that there's racluster.conf that comes with the source
distribution under support/Config directory and I'm looking at this one
liner -

filter="tcp or udp"    model="saddr daddr proto dport"  status=120
idle=3600  cont

So idle is the idle time out but what actually status and cont means and how
do you tweak it. By the way I found no racluster.conf man page and I'm
curious whether all the configurations shown in examples.

Thanks, I get what you mean that it doesn't prove to be useful for the probe
but rather more on argus client part.

On 12/30/06, carter at qosient.com <carter at qosient.com> wrote:
>
> This is not in 3.0 because it didn't prove to be useful for the
> probe.  The idea is embedded in the aggregators, like racluster/rabins,
> where you can specify the report period and idle timeout values, based on
> any identifier.
>
> How did you want to use this feature?
>
> Carter
>
>
> Carter Bullard
> QoSient LLC
> 150 E. 57th Street Suite 12D
> New York, New York 10022
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax
>
> -----Original Message-----
> From: "CS Lee" <geek00l at gmail.com>
> Date: Fri, 29 Dec 2006 15:23:06
> To:Argus <argus-info at lists.andrew.cmu.edu>
> Subject: [ARGUS] Flow timeout value
>
> Carter,
>
> I just came through this old post from you.
>
> http://permalink.gmane.org/gmane.network.argus/1852: <
> http://permalink.gmane.org/gmane.network.argus/1852>
>
> I'm wondering why this is not in argus 3.x. I think it is great to
> accurately construct the flows since the timeout value are different for
> application protocols. And it can even allign with the application
> setting(as some of network services can specify their connection time out
> values).
>
> Thanks.
>
> --
> Best Regards,
>
> CS Lee<geekooL[at]gmail.com>




-- 
Best Regards,

CS Lee<geekooL[at]gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20070102/88c60e4b/attachment.html>