rmon

[carter at qosient.com]

Hmmmmm,  try:
    racluster -m matrix  -s saddr daddr sbytes dbytes  -r outfile - host 10.2.97.107 and host 203.12.160.187 

This will give you total whatever between the two addresses.  The "matrix" mode strips out protocol specific direction.

You really really really don't want to use the "-M rmon" option, if you want stats between two things.  Rmon stats are for single objects, like address, port, protocol, and you get in-bytes and out-bytes for that object (or whatever stat you print).  The stats you report are only relevant for each saddr, and cannot be combined!!!!.

Carter

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax

-----Original Message-----
From: Robert Leyba <r_leyba14 at yahoo.com>

Date: Mon, 4 Jun 2007 01:35:37 
To:argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] Re: rmon


Hi Carter,   thanks for that.   Here's a much more simplified test.  I made a 
test machine do a quick web page access and did a simple racluster command.


 root at cpocts:/tmp# racluster -M rmon -m saddr -s saddr daddr sbytes dbytes 
bytes -r outfile - host 10.2.97.107 and host 203.12.160.187
       10.2.97.107            0.0.0.0         5695       169694     175389
    203.12.160.187            0.0.0.0       169694         5695     175389


For measurement purposes, is the total bytes that flowed between the two 
machines = 175389 bytes or is it (175389 x 2)  350778 bytes?

Thanks

--robert