[ARGUS] Count flows
fors at chalmers.se
Fri May 1 13:52:10 EDT 2020
I would like to be able to easily find out which ip or port generates
the largest number of flows.
It's easy enought to get this for packets or bytes, but I haven't found
how to do it for flows.
The following gives me a nice list of the src ports genereating the most
traffic packet wise, but not flow wise.
racluster -M rmon -m proto sport -r somefile.ra -w - | rasort -m pkts -r -
More information about the argus