RASORT(1)RASORT(1)NAMErasort - sort argus(8) data file.
COPYRIGHT
Copyright (c) 2000-2008 QoSient. All rights reserved.
SYNOPSISrasort [[-M sortmode] [-m sortmode] ...] [raoptions]
DESCRIPTION
Rasort reads argus data from an argus-data source, sorts the records
based on the criteria specified on the command line, and outputs a
valid argus-stream.
OPTIONS
Rasort, like all ra based clients, supports a number of ra options
including filtering of input argus records through a terminating filter
expression. See ra(1) for a complete description of ra options.
rasort(1) specific options are:
-M replace
Replace the existing file with the sorted output.
-m sortmode Supported sortmodes are:
stime record start time <default>
ltime record last time.
trans aggregation record count.
dur record total duration.
avgdur record average duration.
mindur record minimum duration.
maxdur record maximum duration.
smac source MAC addr.
dmac destination MAC addr.
saddr source IP addr.
daddr destination IP addr.
proto transaction protocol.
sport source port number.
dport destination port number.
stos source TOS byte value.
dtos destination TOS byte value.
sttl src -> dst TTL value.
dttl dst -> src TTL value.
bytes total transaction bytes.
sbytes src -> dst transaction bytes.
dbytes dst -> src transaction bytes.
pkts total transaction packet count.
spkts src -> dst packet count.
dpkts dst -> src packet count.
load bits per second.
sload source bits per second.
dload destination bits per second.
loss pkts retransmitted or dropped.
sloss source pkts retransmitted or dropped.
dloss destination pkts retransmitted or dropped.
ploss percent pkts retransmitted or dropped.
sploss percent source pkts retransmitted or dropped.
dploss percent destination pkts retransmitted or
dropped.
rate pkts per second.
srate source pkts per second.
drate destination pkts per second.
tranref argus transaction reference number.
seq argus sequence number.
smpls source MPLS identifier.
dmpls destination MPLS identifier.
svlan source VLAN identifier.
dvlan destination VLAN identifier.
srcid argus source identifier.
stcpb source TCP base sequence number.
dtcpb destination TCP base sequence number.
tcprtt TCP connection setup round-trip time.
INVOCATION
A sample invocation of rasort(1). This call reads argus(8) data from
inputfile and sorts the IP protocol based argus(8) data, first by the
destination IP address, then by the service (destination) port number
and then by the source IP address, and writes the results to stdout.
For most services, this arranges argus(8) formatted data by server,
service, and then by client.
rasort-r inputfile -m daddr dport saddr - ip
SEE ALSOra(1), rarc(5), argus(8),
FILESAUTHORS
Carter Bullard (carter@qosient.com).
BUGS
07 November 2000 RASORT(1)
