RACOMPARE(1)

✨ RACOMPARE(1) ✨

okay so bestie, welcome to racompare(1) — it's a General Commands Manual page, it lives in section 1, and it is genuinely the main character of sorted-network-flow comparison. Let's get into it 💅

---

🌸 NAME 🌸

racompare — display and compare sorted network flow data. that's the whole job. she shows, she compares, she serves 🫶

---

🎀 SYNOPSIS 🎀

racompare -r baseline:argus.data.file [raoptions] [-- filter-expression]

---

🦋 DESCRIPTION 🦋

So here's the vibe: racompare reads argus(8) data — either from an argus-file or from a remote data source — and then it compares a sorted list of network flow records against flow baselines. iconic behavior honestly.

When the data is read from a file, racompare shows you the resulting flow caches once the file is done, and it updates its status display line with every single input along the way. When it's reading from a live argus data stream instead, racompare will display data asynchronously, in realtime, the moment it arrives from the source. no waiting, no cap ✨

Flow data gets aggregated as it's read (peep racluster.1 for that), and it uses the same aggregation model for the baseline as it does for the input data being compared. The result? A single line for each network transaction encountered in the data stream. one line, one transaction, clean. The default sorting key is matched packets per flow, but bestie, other keys can absolutely be used instead. And like ratop when reading realtime flows from a remote source, flow records that have been idle for more than the default 60s get removed. 🕐

Various output options are all configurable — the specific columns of data to display, the entry idle timeout value, the screen refresh rate, etc ... all of it, your call.

racompare uses ncurses and readline.3 (when available) to give you an emacs.1 or vi.1 look and feel for displaying, navigating and modifying network flow data. Configure these features using readline's configuration strategy — that's .inputrc in the home directory. See man readline. 📖

And while racompare is running, there is so much help available from the on-line help system — just hit the ":h" command. iykyk 💖

---

💜 OPTIONS 💜

Command line option specifications are processed left to right. Options can be specified more than once. If conflicting options get specified, the later specifications override the earlier ones. which is actually so useful — it means you can make a shell alias for racompare with all your preferred defaults baked in, and then override those preferred defaults on the command line whenever you feel like it. slay.

racompare, like all ra-based clients, supports a number of ra options, including filtering of input argus records through a terminating filter expression, plus the ability to specify the output style, format and contents for printing data. See ra(1) for a complete description of ra options. The racompare(1)-specific options are:

• -m aggregation object — pick your aggregation object. Supported aggregation objects are:
  • none — use a null flow key.
  • srcid — argus source identifier.
  • smac — source mac(ether) addr.
  • dmac — destination mac(ether) addr.
  • soui — oui portion of the source mac(ether) addr.
  • doui — oui portion of the destination mac(ether) addr.
  • smpls — source mpls label.
  • dmpls — destination label addr.
  • svlan — source vlan label.
  • dvlan — destination vlan addr.
  • saddr/[l|m] — source IP addr/[cidr len | m.a.s.k].
  • daddr/[l|m] — destination IP addr/[cidr len | m.a.s.k].
  • matrix/l — sorted src and dst IP addr/cidr len.
  • proto — transaction protocol.
  • sport — source port number. Implies use of 'proto'.
  • dport — destination port number. Implies use of 'proto'.
  • stos — source TOS byte value.
  • dtos — destination TOS byte value.
  • sttl — src -> dst TTL value.
  • dttl — dst -> src TTL value.
  • stcpb — src -> dst TCP base sequence number.
  • dtcpb — dst -> src TCP base sequence number.
  • inode[/l|m]] — intermediate node IP addr/[cidr len | m.a.s.k], source of ICMP mapped events.
  • sco — source ARIN country code, if present.
  • dco — destination ARIN country code, if present.
  • sas — source node origin AS number, if available.
  • das — destination node origin AS number, if available.
  • ias — intermediate node origin AS number, if available.
• -M modes — pick your mode. Supported modes are:
  • correct — Attempt to correct the direction of flows by also searching the reverse flow key, if a match isn't found in the cache. This mode is on by default when using the default full 5-tuple flow key definitions.
  • nocorrect — Turn off flow correction for direction. This mode is used by default if the flow key has been changed.
  • preserve — Preserve fields when aggregating matching flow data.
  • nopreserve — Do not preserve fields when aggregating matching flow data.
  • norep — Do not generate an aggregate statistic for each flow. This is used primarily when the output represents a single object. Primarily used when merging status records to generate single flows that represent single transactions.
  • rmon — Generate data suitable for producing RMON types of metrics.
  • nocurses — Do not use the curses interface to present data. This option is primarily used when debugging racompare, to get around the issues of screen manipulation within a debugger like gdb or lldb.

---

🌈 DISPLAY 🌈

The first several lines of the racompare display show global state. The top line shows how racompare is running, with the list of command line options that are in effect — and up in the upper most right corner? the current time ⏰. The next line is the column title line, which labels each column. The bottom line is the command line, where you'll see and prepare ':' commands. And the line just above the bottom line is the status line, showing:

• the number of flows in the racompare process queue
• the display queue
• the total number of flows read
• the rate of flow records read
• the current status — either Active (reading records) or Idle (when all input is complete)

This line can be toggled on or off using ^G.

Flow caches are displayed one per row and are sorted by total pkts, by default. racompare sorting can be configured using the rarc variable RA_SORT_ALGORITHMS, or by using the ":P" command. 💫

racompare supports 3 basic filters:

1. Like all other ra* programs, racompare will send its command line filter to its remote argus data sources, to limit the load on the wire. This is the "remote" filter.
2. racompare also supports a "local" filter, that is applied to flow record input. Normally this is used when the remote argus data source doesn't support the syntax of the specific filter.
3. racompare also supports a "display" filter, that is used to select which flow records are to be displayed. This filter does not have any impact on the internal flow caches that racompare is tracking, so you can change the "display" filter at any time and see the current state of other flows. so flexible of her.

---

🎨 COLOR 🎨

racompare supports color, which is configured using the rarc file. The RA_COLOR_CONFIG file is a fall through specification of flow filters and field color definitions. For flows that match a filter, specific fields in the row will be painted the configured color. And because the filter specification supports the " cont " directive, a single row can be painted by any number of color definitions. a whole lewk, per row. 💅

When color is enabled, racompare will attempt to color IP addresses to indicate that local host address, and the local network. This is very helpful in mobile host installations, where you may not know what IP address has been assigned the localhost. racompare also supports coloring local addresses based on the RA_LOCAL rarc variable.

See racolor.conf.5.

---

🧚 ARGUS EVENTS 🧚

Introduced in argus-3.0.8, racompare supports correlating specific ARGUS_EVENT data with flow data, which can be turned on through the use of the RA_CORRELATE_EVENTS rarc variable. racompare will process argus-lsof event data generated by host bourne argi, and label flow data with user, pid and process name metadata. 🌸

While experimental, it is production level functionality, and can be used with other ra* programs to enhance flow data with host os process information.

See argus-3.0.8 documentation on ARGUS_EVENTS.

---

⭐ EXAMPLES ⭐

racompare -r argus.file -s rank stime dur:14 saddr daddr proto pkts
bytes

Read the file argus.file, and display the resulting aggregated and sorted list of flow records, using the default sorting methods. 🫶

racompare -S localhost

Run racompare as a live display of realtime flow traffic. she's watching, in real time, always. 👑

---

👑 COPYRIGHT 👑

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

💖 AUTHORS 💖

Carter Bullard (carter@qosient.com).

---

🔥 SEE ALSO 🔥

rarc(5) racluster(1) racluster.conf(5) readline(3)

---

and that's the whole page bestie, you ate it up 💅✨ this was racompare 5.0.3, dated 12 July 2023 — go forth and compare those flows, no cap 🦋🎀