[ARGUS] QoS Analysis with Argus

[Chris Schock]

> Hi All,
>
> I'm trying to perform some quality of service analysis with Argus to
> determine true cause of network slow-downs.
>
> I've so far determined times/dates of high traffic
> (bytes+daddr/saddr/dport) and have also used the packets metric to
> cross-check.
>
> The link I am concerned with is a single/dual channel ISDN (2x 64kBps B
> channels) running single channel most of the time and bursting up to
> dual channels in times of high demand.
>
> Can somebody give me an idea of what loss could be expected on such a
> link before a noticeable degredation of service was noticed?

You're probably not experiencing much loss, I'd say your periods of
slow-downs are caused by someone monopolizing the link - note the big gray
bar with a flat top on the right of your first graph. See what application
and person is eating up all your bandwidth.

>
> Also, what is jitter?  My best guess is time between an outgoing packet
> and an incoming packet.  What should be expected?  How many orders of
> magnitude difference would be required to have a perceived massive
> degredation of service?
>

Jitter is the variation in the time between packets arriving, caused by
network congestion, timing drift, or route changes. In othe words, if you
are pinging a remote host for example and it takes 200ms to get replies
every single time, you have no jitter. If it takes 200ms one time and
210ms the next, that is 10ms of jitter.

In your case the jitter is most likely caused by congestion.

> Some graphs of interest are currently available at
> http://jamver.id.au/argus/ if anybody is willing to have a look and
> give me some ideas on directions to look.

Nice graphs!

>
> How would you try to analyse QoS using Argus?  Would you use other
> tools too?

You may want to take a look at netflows if you're using a cisco router.
You could also just sniff the traffic with your favorite sniffer.

>
> cheers,
> James
>