trying to extract and reconstruct specific info form argus file
Riccardo Veraldi via Argus-info
argus-info at lists.andrew.cmu.edu
Sat Mar 19 22:46:07 EDT 2016
Hello,
I am trying to extract specific pattern of traffic from my daily argus
file, for example to make some graph, but I have not coherent results.
For example I Want to see how much data was transferred between host
172.21.32.80 and host 172.21.47.25
So for example:
racount -r argus.out -- host 172.21.32.80 and host 172.21.47.25
racount records total_pkts src_pkts dst_pkts
total_bytes src_bytes dst_bytes
sum 12845 223972263 111508804 112463459
1276653814474 1265563799876 11090014598
now I Want to extract only the info about these 2 IP and have an argus
file only with those info.
ra -L0 -c, -r argus.out -- host 172.21.32.80 and host 172.21.47.25 |
raconvert -r - -w argusfile.tmp
and I again run racount on it
racount records total_pkts src_pkts dst_pkts
total_bytes src_bytes dst_bytes
sum 12652 194539 194539 0
217056818 217056818 0
the number of records match but the byte count is totally different as
well as number of packets.
I Also would run a ragraph
ragraph saddr sbytes daddr dbytes -no-legend -M 10s -r argusfile.tmp
it works but the result matches the 200MB not 1.16TB of course.
what I am missing here ?
I need to extract argus file specific information to match pecific
pattern of traffic and have them in smaller argus-format files
to make custom "on demand" graphs.
I please ask if anyone has a hint for me.
thank you
Rick
More information about the argus
mailing list