artsportmagg






artsportmagg − utility to aggregate port matrix objects in
time domain


artsportmagg [‐v] [‐l topN] [‐s portlist] [‐i ifIndexList]
             [‐I ifIndexList] [‐h hours] [‐o] [‐q]
             outfile infile(s)

artsportmagg is a utility that reads port matrix objects
from ARTS files (infile(s)) and aggregates them in the time
domain, placing the resulting port matrix object(s) or
selected port table object(s) into an output file (outfile).



‐v   The ‐v option causes artsportmagg to print version
     information and exit immediately.

‐s portlist
     The ‐s portlist option is used to select a set of ports
     to be placed in ArtsSelectedPortTable objects in the
     output file.  In other words, instead of writing port
     matrix objects, we write selected port table objects.
     A selected port table object does not retain the source
     to destination port information, but instead lumps
     traffic into the lower of the source or destination
     port for ports in portlist and lumps those that aren’t
     in portlist into the input counters for port 0.

     portlist may contain hyphens (indicating an inclusive
     range) or commas.  For example, ‐s 1‐1024,6000,7070
     would select ports 1 through 1024 (inclusive), port
     6000 and port 7070.  All traffic for ports outside of
     these values would be lumped into counters for port 0.

‐i ifIndexList
     The ‐i ifIndexList option may be used to select only
     data which contains an interface index attribute in
     ifIndexList.  In other words, the ‐i ifIndexList option
     lets you select data from particular interfaces or sets
     of interfaces.  ifIndexList may contain hyphens
     (indicating an inclusive range) and commas.  For
     example, ‐i 1,2,5‐8 would select data with an interface
     index attribute of 1, 2, 5, 6, 7 or 8.

‐I ifIndexList
     The ‐I ifIndexList option may be used to combine data
     which contains an interface index attribute in
     ifIndexList.  In other words, the ‐I ifIndexList option
     lets you aggregate data across a set of interfaces.
     ifIndexList may contain hyphens (indicating an
     inclusive range) and commas.  For example, ‐I 1,2,5‐8
     would combine all data with an interface index
     attribute of 1, 2, 5, 6, 7 or 8.  The resulting









                             ‐2‐


     aggregate objects will contain an interface index
     attribute of 0.

‐h hours
     The ‐h hours option may be used to specify the period
     of aggregation, in hours.  The hours argument accepts a
     decimal value to permit aggregation by fractional hour
     values.  When the ‐h hours option is not used,
     artsportmagg will write a single port matrix object for
     the entire time interval seen in infile(s) to outfile.

‐l topN
     The ‐l topN option may be used to cause artsportmagg to
     generate selected port table objects based on the
     amount of traffic (in bytes) for eac port.  The top
     topN ports (by bytes of traffic) will have their own
     entries in the resulting selected port table objects,
     and all other ports will be lumped into the entry for
     port 0.

‐o   By default, artsportmagg appends to the output file, so
     you may accumlate aggregate port matrix objects in a
     single file over multiple invocations of artsportmagg.
     You may override this behavior with the ‐o option.
     This will cause artsportmagg to overwrite the output
     file instead of appending to it.

‐q   By default, artsportmagg prints a ’.’ for each port
     matrix object it reads and prints a ’+’ for each object
     it writes.  You may suppress this behavior with the ‐q
     (quiet) option.



artsportmagg ‐h 1.0 /tmp/portmagg1hr.19980821 arts.19980821

artsportms(l), artsportagg(l), artsports(l), artsdump(l),
artsases(l), artsasagg(l), artsnets(l), artsnetagg(l),
artsprotoagg(l), artsprotos(l), artstoc(l), jcdstasbar(l),
jcsrcasbar(l)

artsportagg and documentation written by Daniel W. McRobb
CAIDA, August 1998