rahosts(1) [debian man page]
RAHOSTS(1) General Commands Manual RAHOSTS(1) NAME
rahosts - report network addresses in argus(8) data. COPYRIGHT
Copyright (c) 2000-2003 QoSient. All rights reserved. SYNOPSIS
rahosts [ra-options] -M modes [ expression ] DESCRIPTION
Rahosts reads argus(8) data from an argus data source, and outputs a list of sorted network addresses. Based on user supplied criteria, rahosts can generate lists of IP addresses and/or MAC addresses, if available. With IP addresses, rahosts can track the full network and host address, or any network address, based on the mode indicated. Like all ra based clients, rahosts supports a large number of options, configuration through .rarc files, and input filtering using the terminating filter expression. See the ra(1) man page for details on ra-options and expression syntax. RAHOSTS SPECIFIC OPTIONS
-M mode Specify mode of operation. Supported address modes are ip, ether and all address types. The default is to output IP addresses. When IP Addresses are being processed, the network address can be specified with the additional modes class, classA, classB and classC. EXAMPLES
By default, rahosts will output the unique IP addresses seen in an argus data stream. Using the -M mode options you can output all unique class B network addresses that access the server narly.wave.com: rahosts -r argus.data -M classB host narly.wave.com Print the ethernet addresses used to support the HTTP service. rahosts -r argus.data -M ether dst port http AUTHORS
Carter Bullard (carter@qosient.com). SEE ALSO
ra(1), rarc(5), 07 January 2002 RAHOSTS(1)
Check Out this Related Man Page
RAMON(1) General Commands Manual RAMON(1) NAME
ramon - provide RMON2 style reports from argus(8) data. COPYRIGHT
Copyright (c) 2000-2003 QoSient. All rights reserved. SYNOPSIS
ramon [ra-options] -M (TopN | Matrix | HostProto | HostSvc | Svc) [-M Net/masklen] [ expression ] DESCRIPTION
Ramon reads argus(8) data from an argus data source, aggregates the records, sorts them based on user supplied criteria and generates mod- ified argus data that supports RMON2 style tables and data reporting. Ramon supports the same sorting capabilites and calling syntax as rasort() for specifying the sorting algorithm and order. The output is valid argus data, and can be operated on using any ra*() program. Like all ra based clients, ramon supports a large number of options, configuration through .rarc files, and input filtering using the ter- minating filter expression. See the ra(1) man page for details on ra-options and expression syntax. RAMON SPECIFIC OPTIONS
-M TopN Generate the top N list of network addresses and supply the incoming and outgoing packet and bytes counts. The addresses can be modi- fied using the -M Net mode in addition to this mode. -M Matrix Generate the list of talkers ( A <-> B) and supply the incoming and outgoing packet and byte counts. The talker addresses can be mod- ified using the -M Net mode. -M HostProto Generate the list of protocols that are being used by each address and supply the incoming and outgoing packet and byte counts seen. -M HostSvc Generate the list of services that are being used by each address and supply the incoming and outgoing packet and byte counts seen. -M Svc Generate the list of services (dst port number) and supply the incoming and outgoing packet and byte counts seen. -M Net[/masklen] Track addresses as networks rather than host addresses. If the option masklen is not provided, the addresses are traced as subnets based on their Class network address. -a Don't filter output to match expression filter. This generates the complete set of addresses/nets that contributed to the inbound and outbound metrics. AUTHORS
Carter Bullard (carter@qosient.com). SEE ALSO
ra(1), rasort(1), rarc(5), argus(8), 07 November 2000 RAMON(1)