[ARGUS] argus-2.0.6.fixes.1/FreeBSD-4.10 <=> argus-clients-2.0.6.fixes.1/FC2

[Peter Van Epp]

	As part of my adventures with sasl, I look to have the same issue so 
I guess I get to fix it :-). I have a 4.7 machine and 3 4.9 machines. The 4.7
machine can happily connect to and read data from (even using sasl without
passwords now :-)) from the 4.9 machines. I have yet to get any two of the 
4.9 machines to talk to each other, they get socket errors. I also put sasl
on my MacOS 10 machine and tried it and it does just as poorly. The next step
is to go back to a non sasled version on all machines and see what breaks and
then break out the sniffer and see why it is breaking (having a working pair
should be a big help on this quest). This looks to be bugs in 2.0.6 and need
to be swatted for the .fixes.2 release (whereas sasl is likely a 2.0.7 issue
as an enhancement).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada



On Tue, Aug 10, 2004 at 09:56:38PM -0700, Joe Christy wrote:
> Thanks to all who have responded seriously, both on the list and off, to 
> my earlier postings. I've now devoted another 8 hours to hammering on 
> (non-)interoperability and temporarily run out of ideas.
> 
> There are two new facts, one minor and one not-so-minor, I've come away 
> with:
>     minor) "ra -D8 -S 172.24.4.1" and "argus -S 172.24.4.1 -D8" behave 
> differently(!) Just watch it in gdb; they call different functions, not 
> just merely the same functions in a different order, which I might have 
> been able to understand. This is invariant across gcc-2.95+FreeBSD-4.10, 
> gcc-2.96+FC2, gcc-3.3+FC2, gcc-3.4+FC2.
>     Not-so-minor) On FC2, intermittently, "ra -S 172.24.4.1 -D8", run 
> after "ra -D8 -S 172.24.4.1" will avoid the "No data seen" & exit 
> behavior to function correctly. In other words, intermittently (around 
> 25% of the time), "ra -D8 -S 172.24.4.1 ; "ra -S 172.24.4.1 -D8" will 
> function properly. OTOH,"ra -S 172.24.4.1 -D8 ; ra -D8 -S 172.24.4.1" 
> never does(!!) Once again this is invariant across gcc-2.96+FC2, 
> gcc-3.3+FC2, gcc-3.4+FC2. It is also invariant across compiling and 
> linking argus on FreeBSD-4.10 against the 
> argus-2.0.6.fixes.1/include/pcap.h+/usr/lib/libpcap.a, 
> /usr/include/pcap.h+/usr/lib/libpcap.a, and, from the FreeBSD ports, 
> /usr/local/include/pcap.h+/usr/local/lib/libpcap.a (only the last two of 
> which are actually consistent on FreeBSD-4.10, and only the last of 
> which is also consistent with the FC2 libpcap, i.e. libpcap-0.8.3).
> 
> Does anyone have any suggestions about where to look next? Is it just 
> me, or does the minor fact seem to anyone else to bear on the 
> not-so-minor one?
> 
> 	Joe