RAMON(1)						      General Commands Manual							  RAMON(1)

NAME

       ramon - provide RMON2 style reports from argus(8) data.

COPYRIGHT

       Copyright (c) 2000-2003 QoSient. All rights reserved.

SYNOPSIS

       ramon [ra-options] -M (TopN | Matrix | HostProto | HostSvc | Svc) [-M Net/masklen] [ expression ]

DESCRIPTION

       Ramon reads argus(8) data from an argus data source, aggregates the records, sorts them based on user supplied criteria	and generates mod-
       ified argus data that supports RMON2 style tables and data reporting.

       Ramon supports the same sorting capabilites and calling syntax as rasort() for specifying the sorting algorithm and order.

       The output is valid argus data, and can be operated on using any ra*() program.

       Like all ra based clients, ramon supports a large number of options, configuration through .rarc files, and input filtering using the  ter-
       minating filter expression.

       See the ra(1) man page for details on ra-options and expression syntax.

RAMON SPECIFIC OPTIONS

       -M TopN
	    Generate the top N list of network addresses and supply the incoming and outgoing packet and bytes counts.	The addresses can be modi-
	    fied using the -M Net mode in addition to this mode.

       -M Matrix
	    Generate the list of talkers ( A <-> B) and supply the incoming and outgoing packet and byte counts.  The talker addresses can be mod-
	    ified using the -M Net mode.

       -M HostProto
	    Generate the list of protocols that are being used by each address and supply the incoming and outgoing packet and byte counts seen.

       -M HostSvc
	    Generate the list of services that are being used by each address and supply the incoming and outgoing packet and byte counts seen.

       -M Svc
	    Generate the list of services (dst port number) and supply the incoming and outgoing packet and byte counts seen.

       -M Net[/masklen]
	    Track  addresses  as  networks rather than host addresses.	If the option masklen is not provided, the addresses are traced as subnets
	    based on their Class network address.

       -a   Don't filter output to match expression filter.  This generates the complete set of addresses/nets that contributed to the inbound and
	    outbound metrics.

AUTHORS

       Carter Bullard (carter@qosient.com).

SEE ALSO

       ra(1), rasort(1), rarc(5), argus(8),

								 07 November 2000							  RAMON(1)