argus-2.0.0o

[Carter Bullard]

I agree the magic number seems suspicious, but it
could be right, you never know.

It maybe that your sprintf syntax in racount is still
incorrect for (long long) printing.  I'm thinking that
the byte counts are larger, and the packets are less
than expected.  What sprintf syntax are you using?

Yes I think that once we get the racount() output
fixed, then things will get more understandable.

Carter


-----Original Message-----
From: owner-argus at lists.andrew.cmu.edu
[mailto:owner-argus at lists.andrew.cmu.edu]On Behalf Of Russell Fulton
Sent: Sunday, October 15, 2000 8:30 PM
To: Carter Bullard
Cc: argus at lists.andrew.cmu.edu
Subject: RE: argus-2.0.0o



On Fri, 13 Oct 2000 09:50:27 -0400 Carter Bullard <carter at qosient.com> 
wrote:

> Hey Russell,
> 
> Ragator is not having a problem, its racount on your OS.
> The counts are (long long) and printf needs an %Ld on some
> machines and a %lld on others.  You may need yet another
> incantation to get (long long)'s printed correctly.
> 
> Look on line 86(?) of ./clients/racount.c and add your OS
> to the right line.  With this you'll find that the argus
> data is fine.

Yup, I now get the byte counts correctly:

(this is release 'p', server and clients) 

$bin/racount -r data/2000.10.16/argus-2000.10.16.12.00 
racount: totrcds        161780  rcds    161780  pkts      3948608       
bytes   18834332953

So lets look at the ragator problem again:

$rm test.gator 
$bin/ragator -r data/2000.10.16/argus-2000.10.16.12.00 -w test.gator
$bin/racount -r test.gator                             
racount: totrcds         65536  rcds     65536  pkts      1608943       
bytes   705228742

now 65536 is an awfully suspicious number ;-)

This suggests to me that the problem is FreeBSD specific and that 
something is getting wrapped at 16 bits.  Any ideas for tracking it 
down? 

I.e. it looks as if the piping issue was a red herring (introduced by 
the formatting problems in racount ?).   I can't reproduce this 
behaviour now.

$bin/ragator -r data/2000.10.16/argus-2000.10.16.12.00 -w - | gzip > 
test.gz
$bin/racount -r test.gz    
racount: totrcds         65536  rcds     65536  pkts      1608943       
bytes   705228742

piping produces exactly the same (incorrect) results  -- very strange.

Cheers, Russell.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20001015/40c51543/attachment.html>