appbytes, dappbytes, and sappbytes

Carter Bullard carter at
Thu Feb 21 21:25:59 EST 2013

You have to turn appbytes on in argus.  Its the payload that is transferred in a flow, and allows you to find a lot of scans and
calculate goodput vs throughput.


On Feb 21, 2013, at 8:30 PM, Craig Merchant <cmerchant at> wrote:

> I’ve tried running searches like the following, but the appbytes fields are always 0.  What do those fields represent and what do I need to do to enable them.  An example search is:
> ra -S -c "," -M dsrs=+metric,+agr,+psize,+cocode -n -s "+0appbytes,+1sappbytes,+2dappbytes”
> Thx.
> Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the argus mailing list