sloss, dloss, and loss in rc42

[carter at qosient.com]

Hey Michael,
So there are basically two methods for realizing loss, 1) missing packets and 2) retransmitted packets.  For protocols that have overt sequence numbers, tcp, esp and rtp, missing sequence numbers are counted as loss (with allowance for packets out of order).  For tcp, multiple occurence of the same sequence number indicates retransmissions, which is a direct indicator of loss and are also reported.  

Regardless where the loss occures, the probe will report missing packets as loss, so if the libpcap library is dropping packets, or if all the packets are not captured, it could come up in the flow loss reporting.  Hard to avoid that.

Carter



Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: Michael Hornung <hornung at cac.washington.edu>
Date: Mon, 2 Apr 2007 10:11:37 
To:argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] sloss, dloss, and loss in rc42

Can someone describe how the sloss, dloss, and loss counts will be 
affected by an argus probe that drops packets while monitoring?  In other 
words, if argus files do not contain all packets in a flow, will the 
missing packets be counted as "retransmitted or dropped"?  Or are those 
counts based solely on packets seen in a flow?  It's not clear what 
"dropped" means from the man page.  Thanks.

-Mike