RASORT(1)

NAME
rasort - sort argus(8) data file.

COPYRIGHT
Copyright (c) 2000-2002 QoSient. All rights reserved.

SYNOPSIS
rasort [[-s sortfield] [-s sortfield] ...] [raoptions]

DESCRIPTION

Rasort reads argus data from an argus-data source, sorts the records based on the criteria specified on the command line, and outputs a valid argus-stream.

OPTIONS
Rasort, like all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression. See ra(1) for a complete description of ra options. rasort(1) specific options are:

-s sortfield
    Supported sortfields are:
    startime
        record start time <default>
    lasttime
        record last time.
    duration
        record duration.
    srcaddr
        source IP addr.
    dstaddr
        destination IP addr.
    proto
        transaction protocol.
    sport
        source port number.
    dport
        destination port number.
    stos
        source TOS byte value.
    dtos
        destination TOS byte value.
    sttl
        src -> dst TTL value.
    dttl
        dst -> src TTL value.
    bytes
        total transaction bytes.
    srcbytes
        src -> dst transaction bytes.
    dstbytes
        dst -> src transaction bytes.
    packets
        total transaction packet count.
    srcpackets
        src -> dst packet count.
    dstpackets
        dst -> src packet count.
-v  Reverse the result of comparisons.

INVOCATION
A sample invocation of rasort(1). This call reads argus(8) data from inputfile and sorts the IP protocol based argus(8) data, first by the destination IP address, then by the service (destination) port number and then by the source IP address, and writes the results to stdout. For most services, this arranges argus(8) formatted data by server, service, and then by client.
rasort -r inputfile -s dstaddr -s dport -s srcaddr - ip

SEE ALSO
ra(1), rarc(5), argus(8), tcpdump(1)

FILES

AUTHORS
Carter Bullard (carter@qosient.com).

BUGS