[ARGUS] argus 2.0.5 and 2.0.6 ArgusCalloc problems on OpenBSD 3.5

[Richard Johnson]

At 09:14 -0400 on 2004-05-10, Carter Bullard wrote:
> Hey Richard,
>    This is a new one for me, although it may be related
> to an earlier reported problem with ra* programs and
> FreeBSD, which I've included below.


Indeed, problem solved.  My difficulty was actually bad assumptions on my
part, and I haven't yet had to tweak the test box's kernel.

It turns out that the particular fiber I'm sniffing on contains far more
than what's supposed to be on that span.  It was supposed to be just a few
dozen dialup users' traffic, but now contains a rather loaded internal net
instead.

Top shows a resident usage of 280MB just before the allocation failure.
That's less than the tested 450MB this box maxes out at.  I simply wasn't
expecting it to spike beyond that.  But telling top to sample every second
shows that's what's happening.

Given the traffic pattern and volume it's actually being fed, that kind of
spike is reasonable.  It has nothing to do with the bpf and pcap changes in
OpenBSD 3.5.  As I said, bad assumptions on my part.

Testing on an adjusted span gives me 362MB resident, which seems to be
working OK except for my test box's slow CPU.


Richard