"Bug" in state column width + field appearance option requests
elof2 at sentor.se
elof2 at sentor.se
Tue Mar 29 08:06:09 EDT 2011
"Bug":
No matter if I use RA_FIELD_WIDTH='variable' or 'fixed', the width of the
State field is always 5.
This is way too short! I always use the ra option "-Z both" to see the
full TCP flags of the flows, but now this column is cropped and I only see
"FSPA_" when it should read e.g. "FSPA_FSPA".
If the user is unaware of this cropping behaviour, all kinds of incorrect
conclusions could be made when analyzing the traffic stats.
My workaround: I manually set state:13 in my field specifier.
Request:
Speaking of field widths, I always set stime to stime:9 in order to remove
the annoying leading blanks. I don't understand why there are any in the
first place. Couldn't you remove them per default?
Request:
And speaking about the appearance of fields and values... I would like the
possibility to override the character between addr and port. Currently it
is defaulting to a dot, making the addr+port pair a 5-tuple.
Not all people understand 5-tuples but understand the x.x.x.x:port syntax.
My request is to add an option like ex "RA_ADDR_PORT_FIELD_DELIMITER"
which the user can set to any char, normally '.' (dot), ':' (colon) or
'\t' (tab).
What I'm asking for is to format the output like this:
1.2.3.4:32123 -> 2.2.2.2:80 (using RA_ADDR_PORT_FIELD_DELIMITER=':')
Then I can copy and paste ra output into reports/tickets/emails, without
first having to sed it (or add an explaination of a 5-tuple).
(Ra Version 3.0.4.1)
/Elof
More information about the argus
mailing list