Packet Inter-Arrivel Times (IATs)

[Carter Bullard]

Hey Bjoern,
Argus is designed to give you a lot of flexibility in reporting  
interpacket
arrival times and jitter.  To enable this, run argus() against your  
packet
file with an argus.conf file that has the variable set:

      ARGUS_GENERATE_JITTER_DATA=yes

with this in place, usually placed in /etc/argus.conf (default), or
where ever you like and running argus with the "-F argus.conf"
command line option, the output of argus will have interpacket arrival
times and jitter information in each record.

Depending on the traffic type, you maybe happy with getting 5sec
status reports on a flow, but if you need finer granularity, you can
use the "-S statustime" option to set the time in between reports on
a flow.  The value can be as low as 0.000001s, if you really want
to know how the jitter is going.

Print the interpacket arrival times from the argus data using ra.

    argus -r packet.file -w argus.out
    ra -r argus.out -s +sintpkt +sjit +dintpkt +djit

once you get to this point, send email and I'll fill in the gaps as
to what the numbers mean (as an example, jitter is really std deviation
of the mean interpacket arrival time in uSec, so that it is in the
same scale as the mean, which is also in uSec).   Also, in order
to measure packet jitter for VoIP when there is silence suppression,
there are some additional interpacket arrival values that are tracked.

Hopefully this is helpful, and send email when you get to a point where
you're generating data!!!!!

Carter


On Mar 13, 2007, at 3:53 PM, Bjoern Weiland wrote:

> Hi, I am new to argus and looking for a way to analyze packet inter
> arrival times from a given pcap capture file for investigating  
> traffic.
> Anyone with a hint on that?
>
>
>  -best regards, bjoern
>