argus-clients 3.0.7.25 - floating point in filters

[John Gerth]

Exact comparison of floating point values is an extremely tricky business.
Remember that even though the pcr below might print as " -0.573333 ", the
print values are rounded by default to 6 significant figures.  Also, IEEE
binary floating point values have to be converted to decimal for printing
so some bit patterns might not be exactly represented.

When filtering on floating point, it's advisable to use a range, e.g

   ra .... - pcr gt -0.58 and pcr lt -0.57


John Gerth

On 4/30/14 7:49 PM, CS Lee wrote:
> hi Carter,
> 
> I grabbed the latest argus clients and still have problem with the filter, for example
> 
> ra -nr ssh-normal.arg3 -s saddr daddr pcr
>            SrcAddr            DstAddr    PCRatio
>      192.168.221.1    192.168.221.128  -0.320590
>      192.168.221.1    192.168.221.128  -1.000000
>      192.168.221.1    192.168.221.128  -0.758157
>      192.168.221.1    192.168.221.128  -0.973510
>      192.168.221.1    192.168.221.128  -0.771429
>      192.168.221.1    192.168.221.128  -0.901993
>      192.168.221.1    192.168.221.128  -0.261261
>      192.168.221.1    192.168.221.128  -0.137255
>      192.168.221.1    192.168.221.128  -0.411765
>      192.168.221.1    192.168.221.128  -0.088608
>      192.168.221.1    192.168.221.128   0.000000
>      192.168.221.1    192.168.221.128   0.000000
>      192.168.221.1    192.168.221.128  -0.024390
>      192.168.221.1    192.168.221.128  -0.032258
>      192.168.221.1    192.168.221.128  -0.573333
>      192.168.221.1    192.168.221.128  -0.087719
> 
> Looks good if I just use the filter to match rounded value -
> ra -nr ssh-normal.arg3 -s saddr daddr pcr - 'pcr eq 0'  
>            SrcAddr            DstAddr    PCRatio
>      192.168.221.1    192.168.221.128   0.000000
>      192.168.221.1    192.168.221.128   0.000000
> 
> ra -nr ssh-normal.arg3 -s saddr daddr pcr - 'pcr eq -1'
>            SrcAddr            DstAddr    PCRatio
>      192.168.221.1    192.168.221.128  -1.000000
> 
> For floating value, it seems not working -
> 
> ra -nr ssh-normal.arg3 -s saddr daddr pcr - 'pcr eq -0.573333'
> No output
> 
> ra -nr ssh-normal.arg3 -s saddr daddr pcr - 'pcr eq -0.024390'
> No output
> 
> -- 
> Best Regards,
> 
> CS Lee<geek00L[at]gmail.com <http://gmail.com>>
> 
> http://geek00l.blogspot.com
> http://defcraft.net