[ARGUS] difference in pppd and argus statistics

[Roman Festchook]

On Friday 16 April 2004 00:37, Carter Bullard wrote:
> Hey Roman,
>    The discrepancy is caused by the different meanings of
> "src" and "dst" when it comes to flows vs interfaces.
> The "src" of a tcp connection is the host that initiated
> the TCP.  So if you're allowing TCP connections into your
Yes - I really miss this difference - thank you for fast ansver.

> ppp link, then the src/dst semantics with be reversed
> for those packets, when compared to the ppp link stats.
> You can correct this by using the ramon() tool in the
> argus-clients distribution.
>
>    The total bytes   ppp = 35411866
>                    argus = 35411642
>
> are pretty close.  I suspect that the ppp driver is eating
> some control packets that the libpcap interface is not
> getting, since we're not seeing any non-ip data.
>
> Hope this helps!!!
Sure - thanks!
:)

> Carter

-- 
Roman Festchook
Network Engineer
RF2-UANIC FRA11-RIPE