Fwd: Re: Linksys router...

[Brian Johnson]

Good idea.  I think I've been staring at numbers too long today, my brain quit working.  tcpdump spews forth all my test traffic.  So it must be with how I'm running argus.  Basically what I want to do is generate graphs of our incoming/outgoing bandwidth usage.  So, I'm using argus to gather the data, racount to give me the numbers, and then mrtg to graph the stuff.  But "racount -ar /tmp/argus.out" is giving me numbers that are WAY too low, and "ra -ar /tmp/argus.out" is not showing me any of the traffic from my tests.

That's what leads me to believe I'm running argus wrong.  I've been using:

argus -i eth1 -S 10 -w argus.out

But the sum line of "racount -ar argus.out" is WAY too low.  Usually about 2 to 5 times lower than it should be.  If I download a 20MB file, I will see a sum in the total_bytes column of about 9800000 (rounded up).  After a 40MB file, I see a sum of 13000000.  I even waited a few minutes to make sure argus had written it's data out.

Any ideas?

-Brian

r.fulton at auckland.ac.nz wrote:
>On Mon, 2004-12-20 at 15:13 -0500, Brian Johnson wrote:
>> What is your argus command?  I'm ready to punt this out the window.  Perhaps my "hub" isn't such a hub after all.  I'm still only seeing some traffic, not all, after putting a hub in place of the switch.  
>
>use something simple like tcpdump or ntop to see what traffic is
>actually visible on the interface.  Remember to specify the interface
>with -i if the box has more than one interface.  THis should establish
>if the traffic is visible on the interface or not.
>
>If it isn't then it isn't an argus problem.
>
>Russell
-- 
Brian Johnson
Systems Administrator
ThermoAnalytics, Inc.
906-482-9560 x210
http://www.thermoanalytics.com