"Bug" in state column width + field appearance option requests

elof2 at sentor.se elof2 at sentor.se
Tue Mar 29 08:06:09 EDT 2011


"Bug":
No matter if I use RA_FIELD_WIDTH='variable' or 'fixed', the width of the
State field is always 5.

This is way too short! I always use the ra option "-Z both" to see the
full TCP flags of the flows, but now this column is cropped and I only see 
"FSPA_" when it should read e.g. "FSPA_FSPA".

If the user is unaware of this cropping behaviour, all kinds of incorrect
conclusions could be made when analyzing the traffic stats.

My workaround: I manually set state:13 in my field specifier.



Request:
Speaking of field widths, I always set stime to stime:9 in order to remove
the annoying leading blanks. I don't understand why there are any in the 
first place. Couldn't you remove them per default?



Request:
And speaking about the appearance of fields and values... I would like the
possibility to override the character between addr and port. Currently it
is defaulting to a dot, making the addr+port pair a 5-tuple.

Not all people understand 5-tuples but understand the x.x.x.x:port syntax.

My request is to add an option like ex "RA_ADDR_PORT_FIELD_DELIMITER" 
which the user can set to any char, normally '.' (dot), ':' (colon) or 
'\t' (tab).

What I'm asking for is to format the output like this:
1.2.3.4:32123 -> 2.2.2.2:80 (using RA_ADDR_PORT_FIELD_DELIMITER=':')

Then I can copy and paste ra output into reports/tickets/emails, without 
first having to sed it (or add an explaination of a 5-tuple).

(Ra Version 3.0.4.1)

/Elof



More information about the argus mailing list