Bug in Argus 2.0.3??, and possibly others (not reporting on some traffic)

[Carter Bullard]

Hey Chris,
   Sorry that you had to go through the exercise.
But in some ways its nice to know that argus was
doing the right thing.

   I unfortunately found a bug in response to your
mail, and there is a problem with server side
filtering of output argus records.  I have the fix
and it will come out in argus-2.0.4.

   If anyone is filtering when connected in real-time
to an argus, and the filter involves anything other
than the standard flow descriptors, then you will
have a problem getting all the records.  I'll have
the test version up on the server today.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

   

> -----Original Message-----
> From: Chris Newton [mailto:newton at unb.ca] 
> Sent: Thursday, October 18, 2001 9:24 AM
> To: carter at qosient.com; argus; Peter Van Epp
> Subject: RE: Bug in Argus 2.0.3??, and possibly others (not 
> reporting on some traffic)
> 
> 
> Ok folks.  After some testing and goofing around, it appears 
> that the dumb 
> little nortel switch we have, isn't passing all the packets 
> it sees on the 
> ports we are mirroring to the monitor port.  We even tried 
> Sniffer, it 
> couldn't see those scans.  Sorry for the false alarm :(
> 
> Chris
> 
> >===== Original Message From <carter at qosient.com> =====
> >Actually on different machines, but the same link would be
> >ideal, but the same machine will definitely work.
> >
> >Carter
> >
> >Carter Bullard
> >QoSient, LLC
> >300 E. 56th Street, Suite 18K
> >New York, New York  10022
> >
> >carter at qosient.com
> >Phone +1 212 588-9133
> >Fax   +1 212 588-9134
> >http://qosient.com
> >