[ARGUS] argus-2.0.6.fixes.1/FreeBSD-4.10 <=> argus-clients-2.0.6.fixes.1/FC2

[Peter Van Epp]

	I can't reproduce this on a SUSE system:

Linux version 2.4.21-199-smp4G (root at i386.suse.de) (gcc version 3.3.1 (SuSE Linux)) #1 SMP Fri Mar 12 08:32:35 UTC 2004

the fixes1 vanilla ra on the SUSE box works fine to a server on FreeBSD 4.7,
4.9 and 4.10 (i.e. argus_bpf running on FreeBSD and ra -S running on SUSE
haven't tried the other way). I guess I can ask if anyone around here has 
an  Fedora Core 2 box that they will give me an account on.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Tue, Aug 10, 2004 at 09:56:38PM -0700, Joe Christy wrote:
> Thanks to all who have responded seriously, both on the list and off, to 
> my earlier postings. I've now devoted another 8 hours to hammering on 
> (non-)interoperability and temporarily run out of ideas.
> 
> There are two new facts, one minor and one not-so-minor, I've come away 
> with:
>     minor) "ra -D8 -S 172.24.4.1" and "argus -S 172.24.4.1 -D8" behave 
> differently(!) Just watch it in gdb; they call different functions, not 
> just merely the same functions in a different order, which I might have 
> been able to understand. This is invariant across gcc-2.95+FreeBSD-4.10, 
> gcc-2.96+FC2, gcc-3.3+FC2, gcc-3.4+FC2.
>     Not-so-minor) On FC2, intermittently, "ra -S 172.24.4.1 -D8", run 
> after "ra -D8 -S 172.24.4.1" will avoid the "No data seen" & exit 
> behavior to function correctly. In other words, intermittently (around 
> 25% of the time), "ra -D8 -S 172.24.4.1 ; "ra -S 172.24.4.1 -D8" will 
> function properly. OTOH,"ra -S 172.24.4.1 -D8 ; ra -D8 -S 172.24.4.1" 
> never does(!!) Once again this is invariant across gcc-2.96+FC2, 
> gcc-3.3+FC2, gcc-3.4+FC2. It is also invariant across compiling and 
> linking argus on FreeBSD-4.10 against the 
> argus-2.0.6.fixes.1/include/pcap.h+/usr/lib/libpcap.a, 
> /usr/include/pcap.h+/usr/lib/libpcap.a, and, from the FreeBSD ports, 
> /usr/local/include/pcap.h+/usr/local/lib/libpcap.a (only the last two of 
> which are actually consistent on FreeBSD-4.10, and only the last of 
> which is also consistent with the FC2 libpcap, i.e. libpcap-0.8.3).
> 
> Does anyone have any suggestions about where to look next? Is it just 
> me, or does the minor fact seem to anyone else to bear on the 
> not-so-minor one?
> 
> 	Joe