Provided by: argus-client_2.0.6.fixes.1-3_amd64 bug


       rahosts - report network addresses in argus(8) data.


       Copyright (c) 2000-2003 QoSient. All rights reserved.


       rahosts [ra-options] -M modes [ expression ]


       Rahosts  reads  argus(8)  data  from  an  argus  data source, and outputs a list of sorted
       network addresses.  Based on user supplied criteria, rahosts  can  generate  lists  of  IP
       addresses  and/or  MAC  addresses, if available.  With IP addresses, rahosts can track the
       full network and host address, or any network address, based on the mode indicated.

       Like all ra based clients, rahosts supports  a  large  number  of  options,  configuration
       through .rarc files, and input filtering using the terminating filter expression.

       See the ra(1) man page for details on ra-options and expression syntax.


       -M mode
            Specify  mode  of  operation.   Supported address modes are ip, ether and all address
            types.  The default  is  to  output  IP  addresses.   When  IP  Addresses  are  being
            processed,  the  network  address  can  be specified with the additional modes class,
            classA, classB and classC.


       By default, rahosts will output the unique IP addresses seen  in  an  argus  data  stream.
       Using  the -M mode options you can output all unique class B network addresses that access
       the server

              rahosts -r -M classB host

       Print the ethernet addresses used to support the HTTP service.

              rahosts -r -M ether dst port http


       Carter Bullard (


       ra(1), rarc(5),

                                         07 January 2002                               RAHOSTS(1)