fragonly

elof2 at sentor.se elof2 at sentor.se
Thu Feb 9 09:44:15 EST 2012


The ra manual says:

   Primitives  that select flows that experienced fragmentation.
   frag and fragonly


If I run 'ra -nr argus.log - frag', I only get a couple of lines as 
output. Good.

If I run 'ra -nr argus.log - fragonly', I get equally many lines of output 
as if I use no filter at all.

#ra -nr /usr/sentor/48h/argus.log - fragonly | wc -l
   565648
#ra -Zb -nr argus.log - | wc -l
   565648


What is the 'fragonly' keyword meant to do?

/Elof



More information about the argus mailing list