COPYRIGHT

Copyright (c) 2000-2008 QoSient. All rights reserved.

SYNOPSIS

rahisto [-M histomode] -H bin[L]:range|size ... [raoptions]

DESCRIPTION

Rahisto reads argus data from an argus-data source, sorts the records based on the criteria specified on the command line, and outputs a valid argus-stream.

OPTIONS

Rahisto, like all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression. See ra(1) for a complete description of ra options. rahisto(1) specific options are:

-M nozero

Don't print bins that have zero frequencies.

-M outlayer

Print accumulated stats for outlayer values, i.e. the values that are outside the histogram range.

-H metric bin[L]:range | size

Supported metrics are:

dur

record total duration.

avgdur

record average duration.

proto

transaction protocol.

sport

source port number.

dport

destination port number.

stos

source TOS byte value.

dtos

destination TOS byte value.

sttl

src -> dst TTL value.

dttl

dst -> src TTL value.

[s|d]bytes

[src | dst] transaction bytes.

[s|d]appbytes

[src | dst] application bytes.

[s|d]pkts

dst -> src packet count.

[s|d]load

packets per second.

[s|d]loss

pkts retransmitted or dropped.

[s|d]ploss

percent pkts retransmitted or dropped.

[s|d]rate

bits per second.

INVOCATION

A sample invocation of rahisto(1). This call reads argus(8) data from inputfile and generates a frequency distribution histogram for the round-trip time of arp volleys in argus(8) data, between two hosts in a local area network, a.b.c.d and a.b.c.e.

rahisto -H dur 20:50-150u -r inputfile -M outlayer - arp and src pkts 1 and dst pkts 1

FILES

AUTHORS

Carter Bullard ([email protected]).