racluster 3.0.6 vs 3.0.8 default aggregation?

[Patrick Forsberg via Argus-info]

On 12/20/2016 10:31 AM, Patrick Forsberg via Argus-info wrote:
> Hi,
> 
> I'm going nuts over aggregation in 3.0.6 and 3.0.8 and realize that I obviously haven't understood a thing.
> 
> Given a simple UDP flow between two hosts
> # ra -X -r /tmp/ratest 
>          StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts   TotBytes State 
>    09:04:56.941624  e           udp          100.0.1.1.42461     ->          100.0.2.1.59307         1         77   INT
>    09:04:57.064776  e           udp          100.0.2.1.59307     ->          100.0.1.1.42461         1         62   INT
>
> Running 3.0.8 with "-M correct" gives the same result as for 3.0.6
> 
> #  /usr/local/src/Argus/argus-clients-3.0.8/bin/racluster -X -M correct -s+trans -r /tmp/ratest
>          StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts   TotBytes State  Trans 
>    09:04:56.941624  e           udp          100.0.1.1.42461    <->          100.0.2.1.59307         2        139   CON      2
> 
> This implies that 3.0.8 doesn't use the classic 5-tuple (what is the classic 5-tuple by the way?) and I thought I was on to something until I tried
> 
> #  /usr/local/src/Argus/argus-clients-3.0.8/bin/racluster -X -m saddr daddr sport dport -M correct -s+trans -r /tmp/ratest
>          StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts   TotBytes State  Trans 
>    09:04:56.941624  e           udp          100.0.1.1.42461     ->          100.0.2.1.59307         1         77   INT      1
>    09:04:57.064776  e           udp          100.0.2.1.59307     ->          100.0.1.1.42461         1         62   INT      1
> 
> Now all of a sudden "-M correct" doesn't seem to help in aggregating the records.

Now I've done some tests with racluster.conf and I am not less confused unless there's a bug in here somewhere.

## racluster.conf ##
RACLUSTER_AUTO_CORRECTION=yes
filter=""              model="saddr daddr proto dport sport “
## racluster.conf ##

#  /usr/local/src/Argus/argus-clients-3.0.8/bin/racluster -r /tmp/ratest  -f racluster.conf -s+trans 
         StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts   TotBytes State  Trans 
   09:04:56.941624  e           udp          100.0.1.1.42461    <->          100.0.2.1.59307         2        139   CON      2

So why does options in racluster.conf work differently from those given on the command line?

/Patrick