argus and multiple links

[Carter Bullard]

Hey David,
   Yes, currently argus can deal with multiple interfaces,
but there is a compiled limit of 3 interfaces.  No reason
other than conservatism.  If there are cycles, then argus
can handle it.  We fixed a few bugs in this area early in
the argus-2.0.2 code effort, which is almost done, so you
definitely should use argus-2.0.2.beta.5 as a starting point
for your project.

   All of the ra* tools can attach to multiple simultaneous
argus sources, and process records, so collection from
multiple argi is supported.  Not many sites are doing this,
so there may be a bug or two, but it works for me ;o)

  And yes, tools such as ragator() will merge the records
from multiple sources together and recover most of the
information as if they were generated by a single monitor.
The data that will not be recoverable, at least in the
current tools, is loss rate and jitter information.  There
is no current support for clock skew correction among the
independent argi, so some performance metrics will be
a bit off, but with reasonable use of ntp, this is
tolerable.

   I'll defer to some of the better individuals on the
list for hardware performance recommendations.

   Hope this helps, and if you need any help, don't hesitate
to send mail!

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: owner-argus-info at lists.andrew.cmu.edu 
> [mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of 
> David Richardson
> Sent: Tuesday, July 17, 2001 7:10 PM
> To: argus-info at lists.andrew.cmu.edu
> Subject: argus and multiple links
> 
> 
> (Apologies if this is a FAQ; I couldn't find it on the web 
> site) What is the current support for simultaneous monitoring 
> of multiple links?
> 
> I need to monitor a set of four redundant, load balanced 
> links. The links are Gigabit Ethernet, and I plan to use 
> optical splitters, resulting in eight links to cover the full 
> duplex connections.
> 
> While they aren't heavily utilized, I doubt I will be able to 
> install 8 NIC's in a single workstation. It's quite likely 
> that a single flow will be spread across multiple links, and 
> therefor could show up on multiple workstations.
> 
> - Within a single workstation, can Argus collate information 
> from multiple
>   NICs into a single flow?
> 
> - Can Argus collate information from multiple workstations 
> into a single
>   flow?
> 
> - Does anyone have recommendations for platforms that are good at
>   supporting multiple NICs in promiscuous mode?
> 
> 
> Thanks!
> 
>  - David
> 
> 
>