Two more patches against argus-clients-3.0.0.rc.21

[Carter Bullard]

Hey Peter,
    If I apply this patch (to fix the proto for 2.x -> 3.0 conversion  
when
its ipv6), we will not find these flows using the traditional filter  
"ipv6",
but we will match it using "proto ipv6" as the filter.   This is because
ipv6 is the next header protocol, but the records are not ipv6 flows,
as they would have ipv6 addresses in them.

    I think this maybe useful, but it will be confusing.  Not sure what
to do, but I've put the patch in for now, and we'll try it out, but I  
may
take it out later, based on issues.

Carter


On Jul 27, 2006, at 11:17 PM, Peter Van Epp wrote:

> 	A fix for the ether_type problem that was misclassifying non IP
> traffic (it was hiding in a bcopy which is why the first try didn't  
> work) and
> a minor comment typo in a header file. In addition I managed to  
> find and fix
> the seg fault on rarp in ra 2.0.6 so now it doesn't seg fault  
> before finishing
> the comparison. There look to still be a few bugs floating around,  
> but some
> of them are probably due to aggregation differences between 2 and 3.
>
> Peter Van Epp / Operations and Technical Support
> Simon Fraser University, Burnaby, B.C. Canada
>
>
> *** include/argus_def.h.orig	Wed Jul 26 19:24:28 2006
> --- include/argus_def.h	Wed Jul 26 19:26:22 2006
> ***************
> *** 772,783 ****
>      |0|   0x02      |1|D|    0x01   |      0x02     |      0x0B     |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
> !    |                       Source IPv4 Address                     |
>      |                                                               |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
> !    |                    Destination IPv4 Address                   |
>      |                                                               |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> --- 772,783 ----
>      |0|   0x02      |1|D|    0x01   |      0x02     |      0x0B     |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
> !    |                       Source IPv6 Address                     |
>      |                                                               |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
> !    |                    Destination IPv6 Address                   |
>      |                                                               |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>
>
> *** common/argus_util.c.orig	Sat Jul 22 14:08:55 2006
> --- common/argus_util.c	Thu Jul 27 19:25:03 2006
> ***************
> *** 13014,13019 ****
> --- 13014,13020 ----
>                                 break;
>                              default:
>                                 flow->hdr.argus_dsrvl8.qual =  
> ARGUS_TYPE_ETHER;
> + 			      far->flow.flow_union.mac.ehdr.ether_type = argus2- 
> >ahdr.status & 0xFFFF;
>                                 break;
>                           }
>                           flow->hdr.argus_dsrvl8.len    = 5;
>

Carter Bullard
CEO/President
QoSient, LLC
150 E. 57th Street Suite 12D
New York, New York 10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20060731/998ca876/attachment.html>