argus-2.0.0m

[Peter Van Epp]

	I think this one is probably the wire rather than argus. All of a 
sudden tcpdump is acting up as well (i.e. losing packets at higher speeds).
I'll try the changes and see if they do anything. I may have to put the 
router interface back on the wire to make sure tcpreplay is getting all the 
packets to the wire as it should.
	I boosted (or think I did anyway) the bpf buffer size in OpenBSD (it
is 8k by default and I boosted it to 64K) to see if that would help but it
doesn't seem to have changed anything.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada


> 
> Hey Peter,
>    One thing we can do to improve performance
> is to modify some of the queue processing parameters.
> Lets try these simple changes to see if we don't
> see better packet loss numbers.
> 
> Index: ArgusModeler.c
> ===================================================================
> RCS file: /usr/local/cvsroot/argus/server/ArgusModeler.c,v
> retrieving revision 1.68
> diff -r1.68 ArgusModeler.c
> 81,84c81,82
> < //    Argusdflag = 0;
> <
> <       ArgusUpdateInterval.tv_sec  = 1;
> <       ArgusUpdateInterval.tv_usec = 0;
> ---
> >       ArgusUpdateInterval.tv_sec  = 0;
> >       ArgusUpdateInterval.tv_usec = 250000;
> 113c111
> <    ArgusFlowQueue = ArgusNewQueue(128);
> ---
> >    ArgusFlowQueue = ArgusNewQueue(1024);
> 
> 
> Index: ArgusUtil.c
> ===================================================================
> RCS file: /usr/local/cvsroot/argus/server/ArgusUtil.c,v
> retrieving revision 1.32
> diff -r1.32 ArgusUtil.c
> 420c420
> < #define ARGUS_MAXQSCAN  2048
> ---
> > #define ARGUS_MAXQSCAN  256
> 
> 
> Carter
> 
> Carter Bullard
> QoSient, LLC
> 300 E. 56th Street, Suite 17A
> New York, New York  10022
> 
> carter at qosient.com
> Phone +1 212 813-9426
> Fax   +1 212 813-9426
> 
>