parsing argus data for top destination ports

ScottO skippylou at gmail.com
Wed Nov 28 14:49:58 EST 2007


I am trying to go through an argus data capture, tally up the # of bytes 
  and sort by destination port - basically to see a most traffic goes to 
which destination port # type list in a give chunk of time.  I have the 
following, it pulls a top 20 of the bytes, but no destination ports or 
anything else get printed.  I'm sure it is something stupid I'm doing, 
and hope an extra set of eyes will point me in the right direction.

racluster -R /data/argus/arg_cap_11280700 -M rmon -m dport -w - | rasort 
-m bytes -w - | ra -N 20 -s dport bytes:14

Output ends up looking like:
           38663442816
           14960249022
           14815537634
           12783448957
            5963030683
            5832721488
            2398252032
            2398205907
	   ...<snip>...

Thanks in advance.

Scott



More information about the argus mailing list