Filtering with netmasks?

[Carter Bullard]

The syntax changed because we need to input floating point numbers
into the filter, and parsing 10.3 as both a net address and a float 
is/was a bit
confusing for flex/bison.  Hopefully this will not be a major problem.

Carter


Peter Van Epp wrote:
> On Wed, May 02, 2007 at 01:53:12PM -0500, K K wrote:
>   
>> We'd like to be able to generate a "Top 10 users of Internet
>> bandwidth" report for traffic exchanged between internal users and
>> Internet hosts.  Originally I tried this with v2, and I'm now testing
>> with V3.0.0.  In both cases, the host OS is OpenBSD 3.9 (soon to be
>> upgraded to 4.1, released yesterday).
>>
>> We already have the inside-edge Cisco router sending NetFlow to Argus,
>> but not all the traffic crossing this router is Internet traffic, so
>> I'm trying to use filter expressions to report only on the relevant
>> traffic, like this:
>>
>> ra -r /data/argus/argus.2007.05.01.16.50.01.gz -w -
>>  - 'host squidproxy or host socksproxy or not ( src net 205.166.42.
>> or 10. or 172.24. or 172.30.12. or 192.168. ) or not ( dst net
>> 205.166.42. or 10. or 172.24. or 172.30.12. or 192.168. )' | racluster
>> -M rmon -m saddr -w - | rasort -m bytes load -w - | ra -N 10 -s saddr
>> daddr spkts dpkts sbytes dbytes load | tr -s " " | sed -e "s/
>> 0\.0\.0\.0//"
>>
>>     
>
> 	That is likely because filter syntax has changed a bit.
>
> ra3 -r com_argus -n \(src net 142.58.209.\)
>    10:54:58.668335             man               3032      0                    22674      1   766884    40295        22674   3276032916   CON
>    10:54:58.668335             man               3110      0                    22592      1   802514    38178        22592   3325167276   CON
>    10:54:58.668335             man               3364      0                    
>
> 	which now needs to be:
>
> ra3 -r com_argus -n \(src net 142.58.209.0/24\)
>
>    11:59:56.019915  e          tcp      142.58.209.70.1168     <?>      xxx.yy.zzz.aa.80            8        8         9225         1117   CON
>
> 	to get the expected data. Filters of the first form worked in the 
> 2.0 (at least 2.0.6) series but don't on 3.0. 
>
> Peter Van Epp / Operations and Technical Support 
> Simon Fraser University, Burnaby, B.C. Canada
>
>