Ragraph top talker

[Carter Bullard]

Hey Fiorenzi,
If you are interested in input and output metrics, "in/out", for a subset of data,
you will want to run rabins() against your primitive data,  first, and then graph
the subset of IPs from that output.

Try this :
   rabins -M rmon -m saddr -M time 10s -r file -w ipAddrs.10s.out - ip

This will generate in/out metrics for every IP address,  for each 10 second
interval.  Read the ipAddrs.10s.out file using ra() to see what we did:

   ra -r ipAddrs.10s.out | less

Now you can graph this data, filtering out the addresses you are interested in.
rabins() put the IP addresses in the saddr field, so you can use "src" filters.
   
   ragraph sbytes dbytes saddr -M 10s -r ipAddrs.10s.out  - src net 10.x.y.0/24
   ragraph spkts dpkts saddr -M 10s -r ipAddrs.10s.out - src net 10.x.y.0/24

I'm going to be in Rome, for just the weekend.  How is the weather?

Carter



On Aug 29, 2011, at 6:13 AM, Fiorenzi Alessandro wrote:

> Hi, I am trying to graph which are top talkers on my network, I get it using this:
>  
> Top Talker:
> /usr/local/bin/ragraph bytes saddr -M 10s -r /var/log/argus/argus.out -title "Realtime Top Talker Trafffico No proxed network  10.x.y.0/24" -m saddr -w "/var/www/realtime/Top-Talker-y.png" - src net 10.x.y.0/24&
>  
> And this work fine for me.
>  
> Now I would split traffic of toptalkers into up/down to have  a graph with tap talkers and bytes transferred up and down. Anybody have already do this?
>  
> Thanks
>  
> Alessandro Fiorenzi
> 
> Prima di stampare, pensa all'ambiente ** Think about the environment before printing
> 
> Il presente messaggio, inclusi gli eventuali allegati, ha natura aziendale e potrebbe contenere informazioni confidenziali e/o riservate. Chiunque lo ricevesse per errore, è pregato di avvisare tempestivamente il mittente e di cancellarlo.
> E’ strettamente vietata qualsiasi forma di utilizzo, riproduzione o diffusione non autorizzata del contenuto di questo messaggio o di parte di esso.
> Pur essendo state assunte le dovute precauzioni per ridurre al minimo il rischio di trasmissione di virus, si suggerisce di effettuare gli opportuni controlli sui documenti allegati al presente messaggio. Non si assume alcuna responsabilità per eventuali danni o perdite derivanti dalla presenza di virus.
> 
> Per lo svolgimento delle attività di investimento nel Regno Unito, la società è autorizzata da Banca d'Italia ed è soggetta alla vigilanza limitata della Financial Services Authority. Maggiori informazioni in merito ai poteri di vigilanza della Financial Services Authority sono a disposizione previa richiesta..
> 
> Nel Regno Unito Intesa Sanpaolo S.p.A. opera attraverso la filiale di Londra, sita in 90 Queen Street, London EC4N 1SA, registrata in Inghilterra & Galles sotto No.FC016201, Branch No.BR000036
> 
> ***
> 
> This email (including any attachment) is a corporate message and may contain confidential and/or privileged and/or proprietary information. If you have received this email in error, please notify the sender immediately, do not use or share it and destroy this email. Any unauthorised use, copying or disclosure of the material in this email or of parts hereof (including reliance thereon) is strictly forbidden.
> We have taken precautions to minimize the risk of transmitting software viruses but nevertheless advise you to carry out your own virus checks on any attachment of this message. We accept no liability for loss or damage caused by software viruses.
> 
> For the conduct of investment business in the UK, the Company is authorised by Banca d’Italia and subject to limited regulation in the UK by the Financial Services Authority. Details about the extent of our regulation by the Financial Services Authority are available from us on request.
> 
> In the UK Intesa Sanpaolo S.p.A. operates through its London Branch, located at 90 Queen Street, London EC4N 1SA. Registered in England & Wales under No.FC016201, Branch No.BR000036

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20110901/ee9a166b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4367 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20110901/ee9a166b/attachment.bin>