1RASORT(1) General Commands Manual RASORT(1)
2
6 rasort - sort argus(8) data file.
7
9 Copyright (c) 2000-2003 QoSient. All rights reserved.
10
12 rasort [[-M sortmode] [sortmode] ...] [raoptions]
13
15 Rasort reads argus data from an argus-data source, sorts the records
16 based on the criteria specified on the command line, and outputs a
17 valid argus-stream.
18
20 Rasort, like all ra based clients, supports a number of ra options
21 including filtering of input argus records through a terminating filter
22 expression. See ra(1) for a complete description of ra options.
23 rasort(1) specific options are:
24 -M sortmode Supported sortmodes are:
26 time record start time <default>
27 startime record start time <default>
28 lasttime record last time.
29 trans aggregation record count.
30 dur record total duration.
31 avgdur record average duration.
32 saddr source IP addr.
33 daddr destination IP addr.
34 proto transaction protocol.
35 sport source port number.
36 dport destination port number.
37 stos source TOS byte value.
38 dtos destination TOS byte value.
39 sttl src -> dst TTL value.
40 dttl dst -> src TTL value.
41 bytes total transaction bytes.
42 sbytes src -> dst transaction bytes.
43 dbytes dst -> src transaction bytes.
44 pkts total transaction packet count.
45 spkts src -> dst packet count.
46 dpkts dst -> src packet count.
47 load bits per second.
48 loss pkts retransmitted or dropped.
49 rate pkts per second.
50 tranref argus transaction reference number.
51 seq argus sequence number.
52 srcid argus source identifier.
53
56 A sample invocation of rasort(1). This call reads argus(8) data from
57 inputfile and sorts the IP protocol based argus(8) data, first by the
58 destination IP address, then by the service (destination) port number
59 and then by the source IP address, and writes the results to stdout.
60 For most services, this arranges argus(8) formatted data by server,
61 service, and then by client.
62 rasort -r inputfile -M daddr dport saddr - ip
64
66 ra(1), rarc(5), argus(8), tcpdump(1)
67
70 Carter Bullard (carter@qosient.com).
71
73 07 November 2000 RASORT(1)