New guy - questions on OS kernel.

[Carter Bullard]

Hey Richard,
   A part of argus has been integrated into a few
Solaris and Irix NIC device drivers, and it has/is being
ported to VxWorks, so yes a part of Argus definitely
can run in kernel space.

   Argus is composed of three basic processes (argus
is multi-process not multi-threaded), one, maybe two
will run in kernel space very well, the third should be in 
user space.  Packet processing and transaction record
generation should be done in kernel space, or on the
NIC itself, for performance reasons.   Argus record
multiplexing could be in the kernel, but probably better
in user space, and Argus output processing, as it currently
is implemented probably should be done in user space,
for scheduling reasons.

   There is one issues that I am aware of with running
the existing Argus code in kernel space.  It has a lot
of global variables, which will need to be moved to a
control block of some kind.

   Libpcap provides very nice UTC time stamps on Linux.
They are rather reliable at the uSec level.

   Argus has been running on Linux for about 5 years now,
and so we can cover most kernel versions that are out there.

Hope this helps,

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com


> -----Original Message-----
> From: owner-argus-info at lists.andrew.cmu.edu 
> [mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of 
> Dr. Richard W. Tibbs
> Sent: Monday, November 26, 2001 9:22 PM
> To: argus-info at lists.andrew.cmu.edu
> Subject: New guy - questions on OS kernel.
> 
> 
> Hello, all. Just joined this list.
> I am wondering whether Argus 2.0.3 can be run in kernel space versus 
> user space?
> Also, what is the granularity of the time-stamps provided.? 
> Finallly what linux kernel versions are supported (2.2.16 <--> 2.4) ?
> 
> Thanks.
> 
> 
>