.\"
.\" Copyright (c) 2000-2003 QoSient, LLC
.\" All rights reserved.
.\"
.\" THE ACCOMPANYING PROGRAM IS PROPRIETARY SOFTWARE OF QoSIENT, LLC,
.\" AND CANNOT BE USED, DISTRIBUTED, COPIED OR MODIFIED WITHOUT
.\" EXPRESS PERMISSION OF QoSIENT, LLC.
.\"
.\" QOSIENT, LLC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
.\" SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
.\" AND FITNESS, IN NO EVENT SHALL QOSIENT, LLC BE LIABLE FOR ANY
.\" SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER
.\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
.\" ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
.\" THIS SOFTWARE.
.\"
.TH RAHOSTS 1 "07 January 2002"
.SH NAME
\fBrahosts\fP \- report network addresses in \fBargus(8)\fP data.
.SH COPYRIGHT
Copyright (c) 2000-2003 QoSient. All rights reserved.
.SH SYNOPSIS
.B rahosts
[ra-options]
.B -M modes
[
.I expression
]
.SH DESCRIPTION
.IX  "rahosts command"  ""  "\fLrahosts\fP \(em argus data"
.LP
.B Rahosts
reads
.BR argus(8)
data from an \fIargus data\fP source, and outputs a list of sorted network
addresses.  Based on user supplied criteria, \fBrahosts\fP can generate
lists of IP addresses and/or MAC addresses, if available.  With IP
addresses, \fBrahosts\fP can track the full network and host address,
or any network address, based on the \fImode\fP indicated.

Like all ra based clients, 
.B rahosts 
supports a large number of options, configuration through .rarc
files, and input filtering using the terminating filter
\fIexpression\fP.
.LP
See the \fBra(1)\fP man page for details on \fIra-options\fP and
\fIexpression\fP syntax.

.SH RAHOSTS SPECIFIC OPTIONS
.LP
.TP 5 5
.B \-M mode
Specify mode of operation.  Supported address modes are
\fBip\fP, \fBether\fP and \fBall\fP address types.  The default
is to output \fIIP\fP addresses.  When IP Addresses are
being processed, the network address can be specified with the
additional \fImodes\fP \fBclass\fP, \fBclassA\fP, \fBclassB\fP
and \fBclassC\fP.


.SH EXAMPLES
.LP
By default, \fBrahosts\fP will output the unique IP addresses
seen in an argus data stream.  Using the -M mode options you
can output all unique class B network addresses that access
the server narly.wave.com:
.RS
.nf

\fBrahosts -r argus.data -M classB host narly.wave.com\fP
.fi
.RE
.LP
Print the \fIethernet\fP addresses used to support the HTTP
service.
.RS
.nf

\fBrahosts -r argus.data -M ether dst port http
.fi
.RE
.br

.SH AUTHORS
.nf
Carter Bullard (carter@qosient.com).
.fi
.SH SEE ALSO
.BR ra (1),
.BR rarc (5),