sloss, dloss, and loss in rc42

[Michael Hornung]

Thanks for the clear info, Carter.

-Mike

On Tue, 3 Apr 2007 at 02:47, carter at qosient.com wrote:

|Hey Michael,
|So there are basically two methods for realizing loss, 1) missing packets and 2) retransmitted packets.  For protocols that have overt sequence numbers, tcp, esp and rtp, missing sequence numbers are counted as loss (with allowance for packets out of order).  For tcp, multiple occurence of the same sequence number indicates retransmissions, which is a direct indicator of loss and are also reported.  
|
|Regardless where the loss occures, the probe will report missing packets as loss, so if the libpcap library is dropping packets, or if all the packets are not captured, it could come up in the flow loss reporting.  Hard to avoid that.
|
|Carter
|
|
|
|Carter Bullard
|QoSient LLC
|150 E. 57th Street Suite 12D
|New York, New York 10022
|+1 212 588-9133 Phone
|+1 212 588-9134 Fax  
|
|-----Original Message-----
|From: Michael Hornung <hornung at cac.washington.edu>
|Date: Mon, 2 Apr 2007 10:11:37 
|To:argus-info at lists.andrew.cmu.edu
|Subject: [ARGUS] sloss, dloss, and loss in rc42
|
|Can someone describe how the sloss, dloss, and loss counts will be 
|affected by an argus probe that drops packets while monitoring?  In other 
|words, if argus files do not contain all packets in a flow, will the 
|missing packets be counted as "retransmitted or dropped"?  Or are those 
|counts based solely on packets seen in a flow?  It's not clear what 
|"dropped" means from the man page.  Thanks.
|
|-Mike
|
|