CONNECTIONS(1)

NAME
connections - compress argus(8) data file.

SYNOPSIS
connections [ -BbhmnEMNORTWX ] [ -C access-file ]
[ -F filter-file ] -r argus-file -w output-file
expression

DESCRIPTION

Connections reads argus data from an argus-file, sorts the status records based on the records start time, combines detail records for a specific flow into a single argus record and writes a valid argus-file to output-file. This effectively converts argus files from detail to non-detail mode, and merges periodic flow reporting to a single argus record, thus compressing the argus file to its most reduced size, but perserving the flow semantics of the output records. Connections allows for specifying a selection criteria for which records should be reduced. The criteria is described in the access-file and/or the boolean expression, using the same syntax as that seen for ra(1) and tcpdump(1).

OPTIONS

-b  Dump the compiled transaction-matching code to standard output and stop.

-C  Match entries against a Cisco access control list that is contained in access-file. This can be used to verify that firewalls based on Cisco products are working as expected. Argus transaction reports corresponding to network traffic that should be blocked by the access control definition, are reported. The file format is that of a single extended access-list definition.

-d  Print debug information relating to Cisco access control list transaction reporting. When debug-level is 1, connections prints the Cisco access control list definition that would cause the argus datum to be rejected. With a debug-level of 2, connections also prints the Cisco access control list definition that permits argus data.

-E  Use transactions that have been established.

-F  Use file as input for the filter expression. An additional expression given on the command line is ignored.

-h  Print an explanation of all the arguments.

-M  Use transactions with multiple routes involved with the transaction. This condition exists when a transaction involves more than a single source and destination MAC address pair.

-N  Use TCP transactions that closed normally.

-O  Use transactions that involved the use of IP options.

-r  Read from the specified argus-file.

-R  Use TCP transactions that were RESET.

-S  Specify a remote-argus-server.

-T  Use transactions that reported because of a TIMED_OUT condition.

-w  Write out matching data to output-file, in argus file format. An output-file of '-' directs connections to write the 'argus-file to stdout, allowing for "chaining" connections commands together.

-W  Use TCP transactions where the source or destination window was set to zero at some time during the transaction.

-X  Use TCP transactions that involved packet retransmissions.

expression
    This tcpdump(1) expression specifies which transactions will be selected. If no expression is given, all transactions are selected. Otherwise, only transactions for which expression is `true' will be dumped. For a complete expression format description, please refer to the tcpdump(1) man page.

AUTHORS
Carter Bullard (cbullard@baynetworks.com).
Chas DiFatta (cd@sei.cmu.edu).
Special thanks to Mark Poepping (poepping@sei.cmu.edu).

SEE ALSO
ra(1), tcpdump(1), argus(8)