RASORT(1)

🌸 RASORT(1) — the rasort manual page, bestie edition 🌸

okay so real talk: this is the manual page for rasort from the General Commands Manual section of your friendly neighborhood man pages. she's a sorting girlie. let's get into it 💅

---

✨ NAME ✨

rasort — sort argus(8) data file.

---

🦋 SYNOPSIS 🦋

rasort [[-M sortmode] [-m sort fields] ...]  [raoptions] [-- filter-expression]

---

💖 DESCRIPTION 💖

So basically Rasort reads argus data from an argus-data source, sorts the records based on the criteria you specify on the command line, and then outputs a valid argus-stream. that's it. that's the whole vibe. clean input, sorted output, no cap ✨

---

👑 OPTIONS 👑

Rasort, like literally all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression. see ra(1) for a complete description of ra options, because she has the full tea 🫖

the rasort(1) specific options are:

• -M replace — replaces the existing file(s) with the sorted output(s). like, out with the old, in with the sorted ✨
• -m field [field ...] — picks your sort fields, bestie. here's every single one she supports:
  • stime — record start time <default> (she's the default, main character energy fr)
  • ltime — record last time.
  • trans — aggregation record count.
  • dur — record total duration.
  • avgdur — record average duration.
  • mindur — record minimum duration.
  • maxdur — record maximum duration.
  • smac — source MAC addr.
  • dmac — destination MAC addr.
  • soui — oui portion of the source MAC addr.
  • doui — oui portion of the destination MAC addr.
  • saddr[/cidr] — source IP addr, with optional cidr specification for IPv4 addresses.
  • daddr[/cidr] — destination IP addr, with optional cidr specification for IPv4 addresses.
  • proto — transaction protocol.
  • sport — source port number.
  • dport — destination port number.
  • stos — source TOS byte value.
  • dtos — destination TOS byte value.
  • sttl — src -> dst TTL value.
  • dttl — dst -> src TTL value.
  • bytes — total transaction bytes.
  • sbytes — src -> dst transaction bytes.
  • dbytes — dst -> src transaction bytes.
  • pkts — total transaction packet count.
  • spkts — src -> dst packet count.
  • dpkts — dst -> src packet count.
  • load — bits per second.
  • sload — source bits per second.
  • dload — destination bits per second.
  • loss — pkts retransmitted or dropped.
  • sloss — source pkts retransmitted or dropped.
  • dloss — destination pkts retransmitted or dropped.
  • ploss — percent pkts retransmitted or dropped.
  • sploss — percent source pkts retransmitted or dropped.
  • dploss — percent destination pkts retransmitted or dropped.
  • rate — pkts per second.
  • srate — source pkts per second.
  • drate — destination pkts per second.
  • tranref — argus transaction reference number.
  • seq — argus sequence number.
  • smpls — source MPLS identifier.
  • dmpls — destination MPLS identifier.
  • svlan — source VLAN identifier.
  • dvlan — destination VLAN identifier.
  • srcid — argus source identifier.
  • stcpb — source TCP base sequence number.
  • dtcpb — destination TCP base sequence number.
  • tcprtt — TCP connection setup round-trip time.
  • smeansz — source mean packet size
  • dmeansz — destination mean packet size
  • sco — source country code
  • dco — destination country code
  • sas — source autonomous system number
  • das — destination autonomous system number

---

🎀 INVOCATION 🎀

here's a sample invocation of rasort(1), because seeing it is believing it. this call reads argus(8) data from inputfile and sorts the IP protocol based argus(8) data, first by the destination IP address, then by the service (destination) port number and then by the source IP address, and writes the results to stdout. for most services, this arranges argus(8) formatted data by server, service, and then by client. it's giving organized 🧚

rasort -r inputfile -m daddr dport saddr - ip

---

💜 COPYRIGHT 💜

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

🌈 SEE ALSO 🌈

ra(1), rarc(5), argus(8),

---

🍓 FILES 🍓

(no entries here bestie, this section is empty in the original too — she said nothing to declare 💀)

---

🙈 AUTHORS 🙈

Carter Bullard (carter@qosient.com).

---

💀 BUGS 💀

(also empty in the original. iconic behavior honestly, no known bugs on the record ✨)

---

and that's the whole page, periodt. this was rasort 5.0.3, dated 21 April 2023, straight from the RASORT(1) corner of the manual. go forth and sort your argus data, bestie, you're gonna slay 🫶💖