(unknown)

Christian O'Donnell c.a.o'donnell at durham.ac.uk
Thu Jan 23 15:35:19 EST 2003


I must ask about some results that Argus is giving me. In early
December, I did some experimentation with Argus by monitoring an
interface in my central router. And it gave me the following results for
loss at saddr (ra -r eth3 -s bytes loss):

0
0
0
0
0
0,7752
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0,2924
0
0
2,381
0

The only traffic passing through eth3 is an audio stream from my audio
server to three separate hosts.
When I mixed this audio stream with traffic from a traffic generator
launching UDP packets into the interface I get, quite predictably, a
marked increase in loss: 0,5155 0 0 2 0,86 3,38 0 2,04 0,19 0 0 5 1,96
6,667 0,42 0 0 0 0 0 2,56 9,09 4,39 0 0 0 0,89 0,7 1,02

So far, so good. Things are making sense. A few weeks later, when
carrying out similar experiments, things are out of control. For
example, losses now at the same interface, with the same applied audio
stream gives me the following values of loss:
12,55
11,9
0
0
12
25
0
31
0
0
0
27
0
0
0
0
21
0
0
30
0
0
0
0

30%, 27%, 21% ????? Where are these values coming from??? How can these
losses occur in a 10Mbit link with solely an audio stream on it? To add
to the confusion, when I look at losses at the interface with both the
audio stream and the generated UDP packets:

0
19,4
0
0
0,33
0
5,88
0
0
0
0
6,45
0
5,88
4,97
0
8,6
2,4
4,42
0
0
6,5
5,06
0
4,8
0,9
0
0
0
0
0
2,9
3,17

Intuitively, we'd think that losses should increase with more traffic on
the network, but they actually decrease. Why is this happening? Why were
the results more reasonable a few weeks ago? Just to prove my point,
when I turn the generated traffic off, losses go back up again: 0 0 6,5
5,06 0 4,8 0,9 0 0 0 0 0 2,9 3,17 1,78 3,9 0 0 0 21,5 0,6 18,5 0 0 0,85
0 32 0 0 0 19,8 0 0 30 33 21 16,9 0,152 34 0 0 6,67 0 23 0 30 0 14 9 0 0
0 9,2 0 0 11 0 0 0

Thanks very much geezer,
Christian
 


More information about the argus mailing list