appbytes, dappbytes, and sappbytes

[Carter Bullard]

You have to turn appbytes on in argus.  Its the payload that is transferred in a flow, and allows you to find a lot of scans and
calculate goodput vs throughput.

Carter

On Feb 21, 2013, at 8:30 PM, Craig Merchant <cmerchant at responsys.com> wrote:

> I’ve tried running searches like the following, but the appbytes fields are always 0.  What do those fields represent and what do I need to do to enable them.  An example search is:
>  
> ra -S 10.10.10.10:561 -c "," -M dsrs=+metric,+agr,+psize,+cocode -n -s "+0appbytes,+1sappbytes,+2dappbytes”
>  
> Thx.
>  
> Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130221/3a998e9c/attachment.html>