NAME

       rastrip - strip argus(8) data file.

COPYRIGHT

       Copyright (c) 2000-2003 QoSient. All rights reserved.

SYNOPSIS

       rastrip [[-M stripfield] [stripfield] ...]  [raoptions]

DESCRIPTION

       Rastrip  reads  argus data from an argus-data source, and removes data sections that are specified on the
       command line, and outputs a valid argus-stream.  If rastrip is run  without  any  stripfield  directives,
       the  default  is to strip out all information from the record except the FAR information and TCP specific
       information.  This default generates an argus-stream that contains the same semantic information that was
       present in argus-1.5 data records, and generates the same output from ra().

OPTIONS

       Rastrip, like all ra based clients, supports a number of ra options including filtering  of  input  argus
       records  through  a  terminating  filter expression.  See ra(1) for a complete description of ra options.
       rastrip(1) specific options are:

       -M [-|+]stripfield

                      Supported stripfields are:
              far            flow descriptors and flow metrics
              mac            media access control addresses
              tcp            TCP specific identifiers and metrics, such as  base  sequence  numbers,  advertised
                             window sizes and retransmission statistics.
              icmp           ICMP  specific  identifiers  and  metrics,  such  as the source address of the ICMP
                             packet, the declared gateway address and the ICMP types and modes, such as ECHO  or
                             Port Unreachable, along with the port value.
              rtp            RTP  and  RTCP  specific  identifiers  and  metrics,  such  as  the  source  stream
                             identifiers, the last sequence number and stream drop statistics.
              igmp           IGMP specific identifiers and metrics.
              arp            IGMP specific identifiers and metrics, such as the MAC address of the responder  to
                             arp requests for a specific address.
              frag           Fragmentation  specific identifiers and metrics, such as the average fragment size,
                             number of fragments in this fragment, last offset seen in this fragment.
              esp            ESP specific identifiers and metrics, such as  the  Security  Identifier  the  last
                             sequence number seen and drop statistics.
              mpls           MPLS specific identifiers, such as the last MPLS label seen on this flow.
              vlan           VLAN  specific  identifiers,  such  as the source and destination VLAN identifiers.
                             flow.
              pppoe          PPPOE specific identifiers, such as the source and destination SAP identifiers.
              agr            Aggregation specific metrics, such as the number of records  aggregated,  the  mean
                             record duration, standard deviations.
              jitter         Jitter  specific  metrics, such as the mean interpacket arrival time while the flow
                             is active, max, min and standard deviation, as well as metrics for while  the  flow
                             is idle.
              user           All user data capture buffers.
              srcuser        User data capture buffer from the source node.
              dstuser        User data capture buffer from the destination node.
              stime          Source jitter information.
              dtime          Destination jitter information.

INVOCATION

       Sample  invocations  of  rastrip(1).   The  first  call reads argus(8) data from inputfile and strips the
       record, leaving only the FAR data, which contains the flow descriptors  and  basic  metrics,  and  jitter
       information.

          rastrip -r inputfile -M far jitter

       The  next  sample  invocation  of  rastrip(1),  adds vlan specific information to the default far and tcp
       information that would normally be retained.

          rastrip -r inputfile -M +vlan

       The next sample invocation of rastrip(1), removes only the user data  capture  buffers  from  the  argus-
       stream, keep the rest of the data intact.

          rastrip -r inputfile -M -user

SEE ALSO

       ra(1), rarc(5), argus(8), tcpdump(1)

FILES

AUTHORS

       Carter Bullard (carter@qosient.com).

BUGS

                                                04 December 2001                                      RASTRIP(1)