parsing argus data for top destination ports
ScottO
skippylou at gmail.com
Wed Nov 28 14:49:58 EST 2007
I am trying to go through an argus data capture, tally up the # of bytes
and sort by destination port - basically to see a most traffic goes to
which destination port # type list in a give chunk of time. I have the
following, it pulls a top 20 of the bytes, but no destination ports or
anything else get printed. I'm sure it is something stupid I'm doing,
and hope an extra set of eyes will point me in the right direction.
racluster -R /data/argus/arg_cap_11280700 -M rmon -m dport -w - | rasort
-m bytes -w - | ra -N 20 -s dport bytes:14
Output ends up looking like:
38663442816
14960249022
14815537634
12783448957
5963030683
5832721488
2398252032
2398205907
...<snip>...
Thanks in advance.
Scott
More information about the argus
mailing list