Further (broken) argus-2.0.0 patches

Neil Long neil.long at computing-services.oxford.ac.uk
Sun Sep 3 05:18:44 EDT 2000


Hello

I am stuck at home on a dial-up pro tem but had a look at v2.0 with Peter's
first patch bundle (will try the second set later).

With Peter's patches it built ok but I had to remove the -lpthread for the
argus server Makefile entry (since the pthreads on my FreeBSD 3.5 laptop is
in one of the default system libs)

I had no success on FreeBSD using the tun0 interface (not surprising) while
on a ppp link but I was able to make some comparisons in output using a
tcpdump data file. There are a couple of problems arising out of this -
first the v2 data file output from ./argus_bpf -r tcpdump -w output.data is
truncated and argus exits with a memory error. However a most of the data is
there.

Running ra or racount and comparing v1.8.1 and v2.0 shows some problems with
the summary of data (the records and packet counts are ok but the byte,
flows, etc are wrong).

I will build a fresh tree again with the new patches for FreeBSD and will
test the comparitive handling of tcpdump data on Solaris tomorrow. I won't
post the error details yet as it may just be that this part of the code is
not really ready for testing, sorry!

Oh and the -a and -e options don't work as advertised (and as in 1.8) and
either are not enabled yet or are related to the data summary problem.

So I am not sure yet whether such tests are a waste of time at this stage of
development however maybe a standard tcpdump trace file could be useful as a
test suite?

Regards
Neil



More information about the argus mailing list