.\"     $Id: aguri.1,v 1.1 2001/03/22 07:19:38 kjc Exp kjc $
.Dd March 17, 2001
.Dt AGURI 1
.Os
.Sh NAME
.Nm aguri
.Nd display aggregation-based traffic profile
.Sh SYNOPSIS
.Nm aguri
.Op Fl 46adhPv
.Op Fl c Ar count
.Op Fl i Ar interface
.Op Fl f Ar pcapfilters
.Op Fl g Ar geometry
.Op Fl l Ar nodes
.Op Fl n Ar plots
.Op Fl p Ar pidfile
.Op Fl r Ar dumpfile
.Op Fl s Ar interval
.Op Fl t Ar thresh
.Op Fl w Ar outputfile
.Op Fl x Ar dsDS
.Op Fl y Ar KM
.Op Ar
.Sh DESCRIPTION
.Nm
is an aggregation-based traffic profiler that records summary
information of network traffic.
.Nm
can be used as a flexible traffic monitoring tool which covers
a wide range of application, from short-term trouble detection to
long-term trend monitoring.
.Pp
.Nm
adapts itself to spatial traffic distribution by aggregating
small spatial fractions so that it does not require any predefined rule.
Thus, 
.Nm
is capable to detect unexpected increase of unknown
protocols and DoS attacks.
Temporal aggregation is achieved by creating a summary of summaries
applying the same algorithm to its outputs.
.Pp
By default, 
.Nm
records 4 fields in an IPv4 or IPv6 packet, that is,
source address, destination address, source port number, destination
port number.
.Pp
.Nm
monitors network traffic using libpcap(3), and produces a summary.  
.Nm
also produces a summary when it receives a HUP signal.
Periodic summaries can be obtained by sending HUP signals from
.Xr cron 8
to the running
.Nm
program.
When
neither an interface nor a dumpfile is specified,
.Nm
reads aguri output files and produces a summary of summaries.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl 4
Process only IPv4 packets.
.It Fl 6
Process only IPv6 packets.
.It Fl a
Enable X11 tree animation.  (experimental)
.It Fl c Ar count
Exit after processing
.Ar count
packets.
.It Fl d
Enable debug outputs.
.It Fl i Ar interface
Listen on
.Ar interface .
.It Fl f Ar pcapfilters
Specify pcap filters.
.It Fl g Ar geometry
Specify window geometry for X11 tree animation.
.It Fl h
Display help information and exit.
.It Fl l Ar nodes
Use the specified number of nodes for each tree.
.It Fl n Ar plots
Output the specified number of plot entries for plot output.
.It Fl P
Output in the plot format.
.It Fl p Ar pidfile
Write the process id to the
.Ar pidfile .
.It Fl r Ar dumpfile
Read packets from
.Ar dumpfile .
(which was created with the -w option of
.Xr tcpdump 1
).
.It Fl s Ar interval
Output a summary every
.Ar interval
seconds.
.It Fl t Ar thresh
Specify the threshold value for aggregation.
The unit is 0.1%.
Default is 10 (1%).
.It Fl v
Print the version number and exit.
.It Fl w Ar outputfile
Direct output to
.Ar outputfile .
By default, output is directed to stdout.
.It Fl x Ar dsDS
Process only the specified field type.
When
.Ar d
is specified, the destination address is processed.
When
.Ar s
is specified, the source address is processed.
When
.Ar D
is specified, the destination protocol is processed.
When
.Ar S
is specified, the source protocol is processed.
.It Fl y Ar KM
Scale the output values for plot output.
When
.Ar K
is specified, values are converted to Kbps.
When
.Ar M
is specified, values are converted to Mbps.
.El
.Pp
.Sh RETURN VALUES
.Nm
returns 0 on success,
and non-zero if the arguments are incorrect or at an error.
.Sh SEE ALSO
.Xr lipcap 3 ,
.Xr tcpdump 1 ,
.Xr cron 8