This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.

AggregateIPAddrPair Element Documentation

NAME

AggregateIPAddrPair -- Click element; sets aggregate annotation based on IP source/destination address pair

SYNOPSIS

AggregateIPAddrPair(KEYWORDS)

Ports: 1 input, 1-2 outputs
Processing: agnostic, but output 1 is push
Drivers: userlevel
Package: analysis (core)

DESCRIPTION

AggregateIPAddrPair sets the aggregate annotation on every passing packet to a flow number based on its IP address pair. Packets with the same source-destination address pair are assigned the same aggregate number, as are reply packets (with source and destination addresses switched). The paint annotation is set to 0 or 1 to indicate which direction the packet was headed. Flow numbers are assigned sequentially, starting from 1. Different flows get different numbers. Paint annotations are set to 0 or 1, depending on whether packets are on the forward or reverse subflow. (The first packet seen on each flow gets paint color 0; reply packets get paint color 1.) Keywords are:

TIMEOUT
The timeout for active address pairs, in seconds. Default is no timeout (address pairs never expire). If a timeout is specified, then information about an address pair is forgotten after that timeout passes; if the address pair occurs again later, it will get a new aggregate annotation.
REAP
The garbage collection interval. Default is 20 minutes of packet time. AggregateIPAddrPair is an AggregateNotifier, so AggregateListeners can request notifications when new aggregates are created and old ones are deleted.

ELEMENT HANDLERS

clear (write-only)
Clears all flow information. Future packets will get new aggregate annotation values.

SEE ALSO

AggregateIPFlows, AggregateCounter, AggregateIP

Generated by 'click-elem2man' from '../elements/analysis/aggregateipaddrpair.hh' on 7/Mar/2009.

COMMENTS

 
elements/aggregateipaddrpair.txt · Last modified: 2009/03/07 17:24 (external edit)
 
Recent changes RSS feed Driven by DokuWiki