fragonly
elof2 at sentor.se
elof2 at sentor.se
Thu Feb 9 09:44:15 EST 2012
The ra manual says:
Primitives that select flows that experienced fragmentation.
frag and fragonly
If I run 'ra -nr argus.log - frag', I only get a couple of lines as
output. Good.
If I run 'ra -nr argus.log - fragonly', I get equally many lines of output
as if I use no filter at all.
#ra -nr /usr/sentor/48h/argus.log - fragonly | wc -l
565648
#ra -Zb -nr argus.log - | wc -l
565648
What is the 'fragonly' keyword meant to do?
/Elof
More information about the argus
mailing list