---
name: "rahosts"
section: "1"
platform: "linux"
package: "argus-client"
version: "2.0.6.fixes.1-3"
release: "Debian 8 (Jessie)"
platforms: ["linux"]
url: "https://new.carta.tech/rahosts"
---

# rahosts(1)

report network addresses in argus(8) data.

## NAME

**rahosts** - report network addresses in **[argus(8)](/argus/8.md)** data.

## COPYRIGHT

Copyright (c) 2000-2003 QoSient. All rights reserved.

## SYNOPSIS

**rahosts** \[ra-options\] **-M modes** \[ *expression* \]

## DESCRIPTION

**Rahosts** reads **[argus(8)](/argus/8.md)** data from an *argus data* source, and outputs a list of sorted network addresses.  Based on user supplied criteria, **rahosts** can generate lists of IP addresses and/or MAC addresses, if available.  With IP addresses, **rahosts** can track the full network and host address, or any network address, based on the *mode* indicated.

Like all ra based clients,  **rahosts** supports a large number of options, configuration through .rarc files, and input filtering using the terminating filter *expression*.

See the **[ra(1)](/ra/1.md)** man page for details on *ra-options* and *expression* syntax.

## RAHOSTS SPECIFIC OPTIONS

- **-M mode**

  Specify mode of operation.  Supported address modes are **ip**, **ether** and **all** address types.  The default is to output *IP* addresses.  When IP Addresses are being processed, the network address can be specified with the additional *modes* **class**, **classA**, **classB** and **classC**.

## EXAMPLES

By default, **rahosts** will output the unique IP addresses seen in an argus data stream.  Using the -M mode options you can output all unique class B network addresses that access the server narly.wave.com:

```
rahosts -r argus.data -M classB host narly.wave.com
```

Print the *ethernet* addresses used to support the HTTP service.

```
rahosts -r argus.data -M ether dst port http
```

## AUTHORS

```
Carter Bullard (carter@qosient.com).
```

## SEE ALSO

[**ra**(1)](/ra/1.md), [**rarc**(5)](/rarc/5.md),