RASTRIP(1)

✨ RASTRIP(1) — the rastrip girlies' guide ✨

okay so bestie, welcome to rastrip, a General Commands Manual situation, and she is so good at what she does. Sit down, grab a strawberry 🍓, let's get into it.

---

🌸 NAME 🌸

rastrip — strip an argus(8) data file. that's it, that's the whole job, and she does it flawlessly 💅

---

🎀 SYNOPSIS 🎀

rastrip [-M [replace] [+|-]dsr [-M ...]]  [raoptions] [-- filter-expression]

---

💖 DESCRIPTION 💖

okay so here's the vibe: rastrip reads argus data from an argus-data source, strips out the records based on whatever criteria you put on the command line, and then outputs a valid argus-stream. lowkey iconic.

why do you care? because it's useful to reduce the size of argus data files. your files get smol. your disk says thank you. 🫶

and one thing she ALWAYS does, no matter what you say: she removes argus management transactions. which means she has the same effect as a not man filter expression. every single time. no exceptions, no cap.

---

✨ OPTIONS ✨

ngl, rastrip, like all ra based clients, supports a whole bunch of ra options, including filtering of input argus records through a terminating filter expression. if you want the complete description of ra options, go read ra(1) — she's the source of truth, fr fr.

the options that are rastrip(1) specific are:

• -M [+|-]dsr — strip the specified dsr (data set record).

the dsrs she supports are:

• flow — flow key data (proto, saddr, sport, dir, daddr, dport)
• time — time stamp fields (stime, ltime).
• metric — basic ([s|d]bytes, [s|d]pkts, [s|d]rate, [s|d]load)
• agr — aggregation stats (trans, avgdur, mindur, maxdur, stdev).
• net — network objects (tcp, esp, rtp, icmp data).
• vlan — VLAN tag data
• mpls — MPLS label data
• jitter — Jitter data ([s|d]jit, [s|d]intpkt)
• ipattr — IP attributes ([s|d]ipid, [s|d]tos, [s|d]dsb, [s|d]ttl)
• suser — src user captured data bytes (suser)
• duser — dst captured user data bytes (duser)
• mac — MAC addresses (smac, dmac)
• icmp — ICMP specific data (icmpmap, inode)
• encaps — Flow encapsulation type indications

and here's the important part 👑 — in the default mode, like when you don't pass -M at all, rastrip removes this default set of dsrs:

encaps, agr, vlan, mpls, mac, icmp, ipattr, jitter, suser, duser

• -M replace — replace the existing file with the newly striped file. out with the old, in with the glow-up 💅

---

🦋 INVOCATION 🦋

a sample invocation of rastrip(1), because examples are the moment, periodt.

this call reads argus(8) data from inputfile and strips the default dsr set but keeps MAC addresses, then writes the result to outputfile:

rastrip -M +mac -r inputfile -w outputfile

and this call removes only captured user data and timings, and writes the result to stdout:

rastrip -M -suser -M -duser -M -time -r inputfile

see how she stacks -M like that? obsessed. 🎀

---

👑 COPYRIGHT 👑

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

🌈 SEE ALSO 🌈

ra(1), rarc(5), argus(8),

---

🌸 FILES 🌸

bestie… there is literally nothing here 💀 this section is empty, she's giving minimalism, we respect it 🙈

---

💜 AUTHORS 💜

Carter Bullard (carter@qosient.com).

---

💀 BUGS 💀

nothing listed here either. no bugs, only vibes ✨ (or at least, none she's telling us about 😭)

---

and that's the whole page, bestie 🫶 this one's from rastrip 5.0.3, dated 05 February 2023, and it's filed under RASTRIP(1) in the General Commands Manual. go strip something. slay. 💖✨🎀🦋