RACOUNT(1)

NAME
racount - count things from an argus(8) data file/stream.

COPYRIGHT
Copyright (c) 2000-2012 QoSient. All rights reserved.

SYNOPSIS
racount [-M addr proto] [ra options]

DESCRIPTION

Racount reads argus data from an argus-file list, and prints out various counts from the data in the file. Racount supports, by default, a single line output that provide total records and pkt and byte counts, broken down by source and destination.

OPTIONS
Racount, like all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression. See ra(1) for a complete description of ra options. racount specfic options are:

-M modes
    Supported modes are:
    proto
        Print a count breakdown on protocols seen. racount will report on IP protocols, ether protocols, arp, rarp and unknowwn.
    addr
        Print a summary report of the occurence of the various types of network addresses encountered. The current list of IANA standard network address types include:
            IPv4 Unicast ThisNet, Reserved, LoopBack, LinkLocal, TestNet and Private
            IPv4 Multicast Local, Internet, AdHoc, Reserved, SdpSap, Nasdaq, DisTrans, SrcSpec, Glop, Admin, OrgLocal and SiteLocal
            IPv6 Loopback, LinkLocal, SiteLocal, Global, V4Compat, V4Mapped and Unspecified
            IPv6 MulticastNodeLocal, MulticastLinkLocal, MulticastSiteLocal, MulticastOrgLocal and MulticastGlobal

EXAMPLE INVOCATION
This example runs racount against a single argus data file, generating the default output.
% racount -r argus.2012.02.13.17.20.00.out.gz
racount   records     total_pkts     src_pkts       dst_pkts       total_bytes        src_bytes          dst_bytes
    sum   336         21319          9266           12053          16954495           1329172            15625323
This example runs racount against a directory containing argus data, generating a protocol breakdown as well as generating a network address summary.
% racount -M proto addr -r argus.2012.02.13.17.20.00.out.gz
racount   records     total_pkts     src_pkts       dst_pkts       total_bytes        src_bytes          dst_bytes
    sum   336         21319          9266           12053          16954495           1329172            15625323
Protocol Summary
    udp   1           28             28             0              14692              14692              0
     ip   222         20751          8891           11860          16799531           1238670            15560861
    udp   103         513            324            189            138274             74068              64206
    udp   1           1              1              0              422                422                0
    arp   7           16             12             4              936                680                256
Address Summary
  IPv4 Unicast              src 0           dst 40
  IPv4 Unicast Private      src 6           dst 3
  IPv6 LinkLocal            src 3           dst 0
  IPv6 Multicast Link Local src 0           dst 3

AUTHORS
Carter Bullard (carter@qosient.com).

SEE ALSO
ra(1), rarc(5), argus(8)