packet size descrepency

[Russell Fulton]

On Sun, 2002-11-10 at 03:39, Carter Bullard wrote:
> Hey Matthew,
>    Your absolutely correct, in that argus counts total
> bytes seen, regardless of the ARGUS_GENERATE_MAC_DATA
> variable.  Seems like this is the right behavior, so 
> that argus generates consistent data.
> 
>    Do you consider this a discrepancy?  We could
> change the name of the variable to ARGUS_INCLUDE_MAC_DATA?
> 

In NeTraMet we have a separate option that determines whether or not you
include the link layer data in the byte counts.  Before we had this I
had statements like Bytes = bytes - 14*PDUs scattered through my
accounting scripts.

For accouting purposes you normally want the IP lenght because that's
what goes over the external wire (fiber ;-).

-- 
Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand

"It aint necessarily so"  - Gershwin