[Bug] filter problem

Carter Bullard carter at qosient.com
Fri Jun 6 15:55:19 EDT 2008


Hey Nick,
Be sure and run ra with the "-b" option and send that output.
This will print the compiler byte code, so I can see what your
particular machine is doing with the filter.  So,

    ra -r argusFile -b - dst port 25 and reset

Carter

On Jun 6, 2008, at 12:55 PM, Nick Diel wrote:

> The following filter (and different variations) doesn't filter  
> correctly:
> dst port 25 and reset
>
> Though splitting the filter up into two passes has the correct  
> outcome.
>
> ra -r argusFile - dst port 25 and reset | wc -l
> 6
>
> ra -r argusFile -w - - dst port 25 | ra -r - - reset | wc -l
> 177
>
> Nick




More information about the argus mailing list