rauserdata ... switches to use ?

[George Jones]

distributed std.sig says:

    #  Services fingerprint file, generated by:
    #      rauserdata -d16 -e encode32

with output like

    Service: ftp             tcp port 21    n =  1043 src =
"32323020                        "

The -d16 appears to bomb when I use it.

>From a posting in the list, I see something like:

    rauserdata -M encode 32

which gives output like

    Service: netbios-ns        udp port 137   n =    25 src = ".|@.........
FIF"  dst = "                "

which raservices appears not to like:

    $ raservices -f protocol.sig -r foo.ra -s +label -L 0 -
   raservices[12511]: 09-22-10 11:19:29 RaCreateSrvEntry: format error
Service: netbios-ns

What are the right set of flags to generate signature files?

Where would one look in the source to determine the unique flags accepted by
ra*

Thanks,
---George
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100922/0cddbf55/attachment.html>