<!doctype linuxdoc system>

<article>

<title>
ARTS net matrix file format
</title>
<author>Daniel McRobb
<date>Aug 1998

<abstract>
This document contains the file format specification for the ARTS
net matrix data.
</abstract>

<toc>

<sect>Overview
<p>

The net matrix object contains packet and byte counters for traffic from
source IP networks to destination IP networks.  It's called a matrix
bacause you can think of it as a sparse matrix with the source network
and mask as the row and the destination network and mask as the column,
with packet and byte counters in each cell.

Like other ARTS objects, the net matrix object contains a header and
attribute section, which are described elsewhere.  This document
describes the format of the data section of the object.

<sect>ArtsNetMatrixData
<p>

<tabular ca=lll>
<bf /field/ <colsep> <bf /size (bytes)/ <colsep> <bf /description/ <rowsep>
<tt>SampleInterval</tt> <colsep> 2 <colsep> packet sampling ratio <rowsep>
<tt>Count</tt> <colsep> 4 <colsep> number of entries in matrix <rowsep>
<tt>TotalPkts</tt> <colsep> 8 <colsep> sum of packets for all entries in matrix <rowsep>
<tt>TotalBytes</tt> <colsep> 8 <colsep> sum of bytes for all entries in matrix <rowsep>
<tt>Orphans</tt> <colsep> 8 <colsep> sum of orphaned samples <rowsep>
</tabular>

<sect>ArtsNetMatrixEntry
<p>

<tabular ca=lll>
<bf /field/ <colsep> <bf /size (bytes)/ <colsep> <bf /description/ <rowsep>
<tt>Descriptor</tt> <colsep> 16 <colsep> defines netmasks plus other field lengths <rowsep>
<tt>Src</tt> <colsep> 1, 2, 3 or 4 <colsep> source network <rowsep>
<tt>Dst</tt> <colsep> 1, 2, 3 or 4 <colsep> destination network <rowsep>
<tt>Pkts</tt> <colsep> 1, 2, 4 or 8 <colsep> packets sent from source network to destination network <rowsep>
<tt>Bytes</tt> <colsep> 1, 2, 4 or 8 <colsep> bytes sent from source network to destination network <rowsep>
</tabular>

<sect1>Descriptor
<p>


</article>
