Argus 2.0 wishes

[Peter Van Epp]

	Good news on the high speed memory front. The DIMM makers have been 
marching forth. Further poking (fulled by a claim of 1 gigabyte per second 
speeds from NEC DIMMs by my Asus motherboard documentation) indicates there 
is a DIMM standard that internally interleaves a bunch of Dram chips and fronts 
them with an associative cache and control logic which claims (and the timing 
diagrams appear to confirm) will do a gigabyte per second (i.e. we get around 
8 memory accesses for a gigabyte ether data stream at full tilt boogie 
providing the card interface is 64 bits wide). So assuming we can find 
Gigether cards that will do wire speed a high end PC should serve even at 
gigether speeds.
	As well that reminded me of another request for the next version: 
support for full duplex on two interface cards. I haven't poked at libpcap
to see if it will do it, but corelreef does on the ATM side and it is probably
necessary for Argus too. A Shogoti box (or optical splitters if we are on 
fibre) will split the signal into two and invert the transmit on to the receive
lines to provide the physical interface (and isolation of the Argus machine
from the sniffed net). It may be that this would work now, I haven't had time
to poke at it and see, but if not it is a desirable feature. 
	As I may have mentioned before at least counting the size of non IP
packets (so that accurate traffic counts are available) would be a good thing
too.

Peter Van Epp / Operations and Technical Support