Jitter and intrapacket delay

[Peter Van Epp]

On Thu, Jul 12, 2007 at 04:04:56PM +0200, Urtho wrote:
> 
> On 2007-07-10, at 17:55, Peter Van Epp wrote:
> 
> >On Tue, Jul 10, 2007 at 12:10:37PM +0000, Carter Bullard wrote:
> >>That suggests that argus is not generating the data.  Double check  
> >>that argus is actually using a configuration that correctly turns  
> >>jitter on..  What version are you using?
> >>
> 
> Is there any way I can dump the data in some format that shows all of  
> the content so I can see if this is a problem in collector or tools ?
> 
> Urtho,

	You might want to try removing all of your argus.conf files and 
run argus from the command line. The argus my data is from runs from this:

argus -JR -P 560 -i eth0 -i eth1 -U 512 -m -D8  -F /scratch/argus.conf >>/scratch/com.debug.log 2>&1 &

hcids:/scratch # cat /scratch/argus.conf
ARGUS_COLLECTOR=no

which has the effect of doing everything from the command line. It may be that
you have multiple argus.conf files and it is picking up one that is unexpected
(the argus.conf man page I think gives the search order, and the command line
overrides everything else if I recall correctly. The -RJ above enable response
time and jitter data in the argus and the ra command that I used to display
it was in the other message (I can also dig it up again if needed). You don't
want the -D 8 (which turns on heavy debugging :-)) in the line above though. 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada