some questions

[Carter Bullard]

Hey Chris,
   These questions are best answered on the argus
mailing list, so I hope you don't mind.

   Because argus maps ICMP packet to actual flows,
we'll report any ICMP event that pertains to a given
flow.  With ra(), this show up as a 'I' indication
in the indicator field.  So, yes, if a flow is redirected,
or if it failed to reach its destination because of
Unreachable status, for whatever reason, we will report
it.

   With regard to any identifier changing, MAC
address, VLAN tag, MPLS tag, TOS, TTL.  Because these
identifiers can affect how the network treats packets,
Argus provides an indication of the dynamic change of
the network.  A change in TTL indicates that your packets
are going over a dynamically changing path, which may
explain why your not seeing the performance you expect,
or that there is routing instability somewhere in the
network.  A change in TOS may explain why your packet
loss metrics unexpectedly increased.

Hope this helps,

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: Chris Newton [mailto:newton at unb.ca] 
> Sent: Thursday, November 15, 2001 11:57 PM
> To: carter at qosient.com
> Subject: some questions
> 
> 
> On your web site, here: http://www.qosient.com/argus/metrics.htm
> 
> this following section:
> 
>  IPv4 Based Flows
> 
>   Identifiers
>    IP Options (if set)
>    IP Identification (last seen ip_id)
> Metrics
>     Source and Destination
>       ToS/DSByte
>       TTL
>    Indications
>       ICMP Redirect
>       ICMP UnReachable
>       ICMP TimeExceeded
>       IP Fragments Present
>       ToS Byte Changed
>       TTL value Changed
> 
> 
>   Does that last part say that, for a given flow, there is an 
> indicator set if 
> the flow was asked(and did) to redirect, or that the destination was 
> unreachable... so on?
> 
>   Also, what are the consequences/interesting parts about of 
> having the ToS or 
> TTL values in a given flow change?
> 
> 
>