Be very specific that max must be greater than keep.
[darkstat] / export-format.txt
1 The darkstat export format was designed by Ben Stewart.
2 Note that all integers are stored in network order (big-endian).
3
4 FILE HEADER 0xDA314159                              darkstat export format
5     SECTION HEADER 0xDA 'H' 'S' 0x01                hosts_db ver1
6         HOST COUNT 0x00000001                       1 host follows
7         For each host:
8             HOST HEADER 'H' 'S' 'T' 0x02            host ver2
9             IP ADDR 0x0A010101                      IPv4 10.1.1.1
10             MACADDR 0x001122334455                  00:11:22:33:44:55
11             LAST_SEEN 0x0000000048000123 (time_t)   2008-04-12 00:24:03 UTC
12             HOSTNAME 0x09 "localhost"               9 is the string length
13             IN 0x0000000000123456                   Bytes in: 1193046
14             OUT 0x0000000000789ABC                  Bytes out: 7903932
15             PROTOS DATA 'P'                         start ip proto data
16                 IP PROTO COUNT 0x03                 3 ip_proto entries
17                 IP PROTO 0x06                       tcp
18                     IN 0x0000000000123456           Bytes in: 1193046
19                     OUT 0x0000000000789ABC          Bytes out: 7903932
20                 IP PROTO 0x11                       udp
21                     IN 0x0000000000000444           Bytes in: 1092
22                     OUT 0x0000000000000555          Bytes out: 1365
23                 IP PROTO 0x01                       icmp
24                     IN 0x0000000000000001           Bytes in: 1
25                     OUT 0x0000000000000002          Bytes out: 2
26             TCP DATA 'T'                            start tcp proto data
27                 TCP PROTO COUNT 0x0001              1 tcp_proto entry
28                 PORT 0x0050                         http (port 80)
29                     SYN COUNT 0x0000000000000003    SYNs: 3
30                     IN 0x0000000000000001           Bytes in: 1
31                     OUT 0x0000000000000002          Bytes out: 2
32             UDP DATA 'U'                            start udp proto data
33                 UDP PROTO COUNT 0x0001              1 udp_proto entry
34                 PORT 0x0045                         tftp (port 69)
35                     IN 0x0000000000000001           Bytes in: 1
36                     OUT 0x0000000000000002          Bytes out: 2
37     SECTION HEADER 0xDA 'G' 'R' 0x01                graph_db ver1
38         LAST_TIME (time_t as 64-bit uint)
39         For each of 4 graphs: (60 seconds, 60 minutes, 24 hours, 31 days)
40             8 bits - number of bars in this graph
41             8 bits - index of last_time bar, in the range [0:n_bars)
42             For each bar:
43                 64 bits - bytes in
44                 64 bits - bytes out
45
46 Host header version 1 is just version 2 without the last_seen time.