[ARGUS] ragator overflow?

Torbjorn.Wictorin at its.uu.se Torbjorn.Wictorin at its.uu.se
Wed Sep 22 09:20:55 EDT 2004


I try to generate some statistics using ragator. When only src address
is used, it seems to work:

Model 300 ip          no     no    no

gives a nice listing of traffic from my network in a.b.c.0 order.
But when I use

Model 400 ip    no     no    no

to get traffic from c-net to c-net the first xxx records looks ok, then
it starts coming out complete src ip numbers (a.b.c.4 a.b.c.10 etc)

I looked in the source for ragator. There is a constant RA_HASHTABLESIZE
that sets the size of the hashtable. Could

- that one be to small?
- one increase the value without fishy things happening?
- or is there something I do not understand?

Torbjörn Wictorin, Uppsala univ.

More information about the argus mailing list