trying to extract and reconstruct specific info form argus file

Riccardo Veraldi via Argus-info <[email protected]>
Newsgroups gmane.network.argus
Message-ID <[email protected]>
Hello,
I am trying to extract specific pattern of traffic from my daily argus 
file, for example to make some graph, but I have not coherent results.

For example I Want to see how much data was transferred between host 
172.21.32.80 and host 172.21.47.25

So for example:

racount -r argus.out -- host 172.21.32.80 and host 172.21.47.25

racount   records     total_pkts     src_pkts       dst_pkts 
total_bytes        src_bytes          dst_bytes
     sum   12845       223972263      111508804      112463459 
1276653814474      1265563799876      11090014598


now I Want to extract only the info about these 2 IP and have an argus 
file only with those info.

ra -L0 -c, -r argus.out -- host 172.21.32.80 and host 172.21.47.25 | 
raconvert -r - -w argusfile.tmp

and I again run racount on it

racount   records     total_pkts     src_pkts       dst_pkts 
total_bytes        src_bytes          dst_bytes
     sum   12652       194539         194539         0 
217056818          217056818          0

the number of records match but the byte count is totally different as 
well as number of packets.
I Also would run a ragraph

ragraph saddr sbytes daddr dbytes -no-legend -M 10s  -r argusfile.tmp

it works but the result matches the 200MB not 1.16TB of course.

what I am missing here ?

I need to extract argus file specific information to match pecific 
pattern of traffic and have them in smaller argus-format files
to make custom "on demand" graphs.

I please ask if anyone has a hint for me.

thank you

Rick
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.