Argus flow direction
carter at qosient.com
Tue May 9 15:52:34 EDT 2017
racluster.1 does have the ability to ‘correct’ flow records for the direction, and I think that should be the default behavior. Its possible that the default is being changed (.rarc ??). Try racluster with the “-M correct” option to see if you can force correction.
There are exceptions for correction, especially when you are processing flow records from different sources. Do both of these flow records have the same ‘srcid’ ??
Try “-M correct”, if that doesn’t work, generate a data file with these two records in them, and I’ll take a look …
Hope all is most excellent,
> On May 9, 2017, at 1:29 PM, tbh <tbh1000 at gmail.com> wrote:
> Greetings to the list...
> I'm trying to understand why I'm seeing a second flow with an ambiguous direction for this traffic. Given the saddr, sport, daddr, dport, proto are all the same and the start/last times fit within the first line, I would have thought it would have been considered part of that connection.
> racluster -m saddr sport daddr dport -r argus-eth0.20170307*.gz -s stime ltime proto saddr sport dir daddr dport pkts bytes dur - ipv4 and proto 6 and net 220.127.116.11/24 <http://18.104.22.168/24>
> StartTime LastTime Proto SrcAddr Sport Dir DstAddr Dport TotPkts TotBytes Dur
> 17-03-07 16:04:56.830048 17-03-07 16:31:07.160901 6 22.214.171.124.64453 -> 126.96.36.199.7610 10 1799 1570.3308*
> 17-03-07 16:26:39.835133 17-03-07 16:26:39.835244 6 188.8.131.52.7610 <?> 184.108.40.206.64453 2 120 0.000111
> Any insight would be appreciated!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the argus