[ARGUS] Count flows

Patrick Forsberg fors at chalmers.se
Fri May 1 13:52:10 EDT 2020


I would like to be able to easily find out which ip or port generates
the largest number of flows.
It's easy enought to get this for packets or bytes, but I haven't found
how to do it for flows.

The following gives me a nice list of the src ports genereating the most
traffic packet wise, but not flow wise.
racluster -M rmon -m proto sport -r somefile.ra -w - | rasort -m pkts -r - 


Patrick Forsberg

More information about the argus mailing list