argus and multiple links

Carter Bullard carter at
Wed Jul 18 16:58:36 EDT 2001

Hey David,
   Either loss or retransmissions can be hard to recover.
Argus does a lot of work to try to understand if there are
TCP retransmissions.  Transmissions of ACK's are detectable
based on "I've already seen this before", and if your round
robining TCP data to 10 different argi, then the odds of you
picking up ACK retransmissions is going to fail.

   With ragator, retransmission numbers are aggregated, so
you will get values when you merge records together, but the
result will not necessarily be the same value you would get
if all the traffic had gone to a single argus.

   For IPSec, streaming audio and video streams, argus
calculates packet loss based on missing sequence numbers.
The current tools don't aggregate these values as the
result would be incorrect, so with merged records, the loss
rate will be zero.  This will change later.

Hope this helps,


Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at
Phone +1 212 588-9133
Fax   +1 212 588-9134

> -----Original Message-----
> From: David Richardson [mailto:drr at] 
> Sent: Wednesday, July 18, 2001 4:45 PM
> To: Carter Bullard
> Cc: argus-info at
> Subject: RE: argus and multiple links
> Thanks for the reply; that's good to hear.
> On Tue, 17 Jul 2001, Carter Bullard wrote:
> > The data that will not be recoverable, at least in the 
> current tools, 
> > is loss rate and jitter information.  There is no current 
> support for 
> > clock skew correction among the independent argi, so some 
> performance 
> > metrics will be a bit off, but with reasonable use of ntp, this is
> > tolerable.
> >
> I can understand not picking up the jitter information, but 
> why not track loss (and by that do you mean tcp 
> retransmission information or something else)?
>  - David

More information about the argus mailing list