Documentation for RITA output

[ethack]

Specifically, the beacon output has tables with obtuse labels, but other modules would benefit as well.

When you run "rita show-beacons", you get a nifty report with the column titles: Score,Source,Destination,Connections,Avg Bytes,TS Range,DS Range,TS Mode,DS Mode,TS Mode Count,DS Mode Count,TS Skew,DS Skew,TS Dispersion,DS Dispersion,TS Duration

• How are the values generated?
• What values represent good or bad? (example: score close to 1.0 is a beacon, score close to 0 is not).

[carrohan]

Do we want a markdown document in the docs folder that runs through all the show commands, or on the --help for each show command, or something else?

[Spriithy]

I would argue in favor of a Markdown document under the docs folder. I think that's the whole point of it !

Maybe out of topic here, but one could also expect to find some documentation on the internals / processes of the analyzer part (for beaconing).