NAME

       rahosts - report network addresses in argus(8) data.

COPYRIGHT

       Copyright (c) 2000-2003 QoSient. All rights reserved.

SYNOPSIS

       rahosts [ra-options] -M modes [ expression ]

DESCRIPTION

       Rahosts  reads  argus(8)  data from an argus data source, and outputs a list of sorted network addresses.
       Based on user supplied criteria, rahosts can generate lists of IP  addresses  and/or  MAC  addresses,  if
       available.   With  IP  addresses,  rahosts  can  track  the full network and host address, or any network
       address, based on the mode indicated.

       Like all ra based clients, rahosts supports a large number of options, configuration through .rarc files,
       and input filtering using the terminating filter expression.

       See the ra(1) man page for details on ra-options and expression syntax.

RAHOSTS SPECIFIC OPTIONS

       -M mode
            Specify  mode  of  operation.   Supported  address  modes  are ip, ether and all address types.  The
            default is to output IP addresses.  When IP Addresses are being processed, the network  address  can
            be specified with the additional modes class, classA, classB and classC.

EXAMPLES

       By  default, rahosts will output the unique IP addresses seen in an argus data stream.  Using the -M mode
       options you can output all unique class B network addresses that access the server narly.wave.com:

              rahosts -r argus.data -M classB host narly.wave.com

       Print the ethernet addresses used to support the HTTP service.

              rahosts -r argus.data -M ether dst port http

AUTHORS

       Carter Bullard (carter@qosient.com).

SEE ALSO

       ra(1), rarc(5),

                                                 07 January 2002                                      RAHOSTS(1)