ramon

RAMON(1)                    General Commands Manual                   RAMON(1)



NAME
       ramon - provide RMON2 style reports from argus(8) data.

COPYRIGHT
       Copyright (c) 2000-2003 QoSient. All rights reserved.

SYNOPSIS
       ramon [ra-options] -M (TopN | Matrix | HostProto | HostSvc | Svc) [-M
       Net/masklen] [ expression ]

DESCRIPTION
       Ramon reads argus(8) data from an argus data source, aggregates the
       records, sorts them based on user supplied criteria  and generates
       modified argus data that supports RMON2 style tables and data
       reporting.

       Ramon supports the same sorting capabilites and calling syntax as
       rasort() for specifying the sorting algorithm and order.

       The output is valid argus data, and can be operated on using any ra*()
       program.

       Like all ra based clients, ramon supports a large number of options,
       configuration through .rarc files, and input filtering using the
       terminating filter expression.

       See the ra(1) man page for details on ra-options and expression syntax.


RAMON SPECIFIC OPTIONS
       -M TopN
            Generate the top N list of network addresses and supply the
            incoming and outgoing packet and bytes counts.  The addresses can
            be modified using the -M Net mode in addition to this mode.

       -M Matrix
            Generate the list of talkers ( A <-> B) and supply the incoming
            and outgoing packet and byte counts.  The talker addresses can be
            modified using the -M Net mode.

       -M HostProto
            Generate the list of protocols that are being used by each address
            and supply the incoming and outgoing packet and byte counts seen.

       -M HostSvc
            Generate the list of services that are being used by each address
            and supply the incoming and outgoing packet and byte counts seen.

       -M Svc
            Generate the list of services (dst port number) and supply the
            incoming and outgoing packet and byte counts seen.

       -M Net[/masklen]
            Track addresses as networks rather than host addresses.  If the
            option masklen is not provided, the addresses are traced as
            subnets based on their Class network address.

       -a   Don't filter output to match expression filter.  This generates
            the complete set of addresses/nets that contributed to the inbound
            and outbound metrics.


AUTHORS
       Carter Bullard (carter@qosient.com).

SEE ALSO
       ra(1), rasort(1), rarc(5), argus(8),



                               07 November 2000                       RAMON(1)