argus and multiple links

[Carter Bullard]

Hey David,
   Either loss or retransmissions can be hard to recover.
Argus does a lot of work to try to understand if there are
TCP retransmissions.  Transmissions of ACK's are detectable
based on "I've already seen this before", and if your round
robining TCP data to 10 different argi, then the odds of you
picking up ACK retransmissions is going to fail.

   With ragator, retransmission numbers are aggregated, so
you will get values when you merge records together, but the
result will not necessarily be the same value you would get
if all the traffic had gone to a single argus.

   For IPSec, streaming audio and video streams, argus
calculates packet loss based on missing sequence numbers.
The current tools don't aggregate these values as the
result would be incorrect, so with merged records, the loss
rate will be zero.  This will change later.


Hope this helps,

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com



> -----Original Message-----
> From: David Richardson [mailto:drr at washington.edu] 
> Sent: Wednesday, July 18, 2001 4:45 PM
> To: Carter Bullard
> Cc: argus-info at lists.andrew.cmu.edu
> Subject: RE: argus and multiple links
> 
> 
> Thanks for the reply; that's good to hear.
> 
> On Tue, 17 Jul 2001, Carter Bullard wrote:
> 
> > The data that will not be recoverable, at least in the 
> current tools, 
> > is loss rate and jitter information.  There is no current 
> support for 
> > clock skew correction among the independent argi, so some 
> performance 
> > metrics will be a bit off, but with reasonable use of ntp, this is
> > tolerable.
> >
> 
> I can understand not picking up the jitter information, but 
> why not track loss (and by that do you mean tcp 
> retransmission information or something else)?
> 
>  - David
> 
>