starttime differences between Argus2 and Argus3

[Carter Bullard]

Hey Dietmar,
Its Argus, rather than racluster, that is generating the inconsistent
data.   The difference is the result of how Argus is dealing with  
retransmitted
SYN packets.  Argus-2.x, when it saw multiple SYNs, over wrote the
stime filed with the timestamp of the last SYN seen, the idea was that
the network performance metrics would be more accurate this way.  BUT,
by the time we got to Argus-3.0, the idea changed so that even when
there is loss, the better stat should include the timestamp of the  
first SYN;
as this better reflects the actual service duration.   The TCP RTT,  
which is
the SYN->SYNACK->ACK exchange, however is currently calculated using
the last SYN seen, so it will try to capture a better estimate of the  
true
round trip time.

So there is a little bit of mess that we should discuss, I suspect.  The
TCP RTT stat is trying to give a sense of the round trip time but at
the same time it is also the sevice/connection establishment time.
When SYNs are dropped, the stat becomes a little messy, because
you don't know which SYN is being responded to.

    Argus-3.0 is the better value, in my opinion, but we could  
rethink what
to do when there are SYN retransmissions.

Opinion?

Carter



On Jul 10, 2006, at 1:36 PM, Dietmar Goldbeck wrote:

> On Mon, Jul 10, 2006 at 10:52:05AM -0400, Carter Bullard wrote:
>>
>> If this is not the issue, can you share some data so I can
>> debug?
>>
>
>   Hi Carter,
>
> attached are two files from argus 2 and argus 3 running on my
> Linux router at home. The interface ippp0 is synchronous ppp for an
> ISDN connection.
>
>   Ciao
>      Dietmar
>
> -- 
>  Alles Gute / best wishes
>      Dietmar Goldbeck         E-Mail: dietmar.goldbeck at schotterweg.de
> Reporter (to Mahatma Gandhi): Mr Gandhi, what do you think of Western
> Civilization?  Gandhi: I think it would be a good idea.
> <argus_ippp0_20060710_074504.log.gz>
> <argus_ippp0_20060710_074505.log.gz>




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20060710/e576caac/attachment.html>