rabins, ragraph and aggregation of protocols

Jesper Skou Jensen jesper.skou.jensen at uni-c.dk
Thu Feb 13 06:18:53 EST 2014

Wow, very elaborate answer.

Thank you very much Carter, as always you nail it.


On 11-02-2014 18:47, Carter Bullard wrote:
> Hey Jesper,
> rabins() is a generic argus data aggregator, so it can be configured with
> a racluster() configuration file, using the -f option.  When using the -f
> option, it should override any “-m fields” command line option you may be
> using, but better to not use the “-m fields” and the “-f racluster.conf”
> option to remove any confusion.
> With this as an example racluster.conf, and you can get away with just
> graphing the ip traffic, you should be able to get what you want:
> filter="tcp"    model="srcid proto"  status=0   idle=0
> filter="udp"    model="srcid proto"  status=0   idle=0
> filter=""       model="srcid "       status=0   idle=0
> With this you can use ragraph to graph the “ proto " object, and
> you’ll get tcp, udp and ip for the graph.
>     ragraph sbytes dbytes proto -M time 1d -f racluster.conf …… - ip

More information about the argus mailing list