help understand output (fwd)

Fri Mar 16 15:14:41 EDT 2007

Thanks a ton Carter!

Please note that the 'ra' man page says srate and drate are in pps, while 
sload and dload are in bps, but apparently the implementation as of rc40 
has the function of those sets of fields reversed.  That was the source of 
my confusion there.

-Mike

On Fri, 16 Mar 2007 at 02:33, Carter Bullard wrote:

|Hey Mike,
|Ra* output can/does generate a Label, by default it should be the first output
|line ("-L 0").  The label does have some units in them, and some of the names
|are informative, like bytes vs bps, etc ...
|
|srate, drate are in bits per second (bps).  sload and dload are packets per
|second (pps).
|
|No tcprtt for a tcp flow indicates that the probe did not see the syn / synack
|/ ack
|voilley.  Records with the actual value may be in an earlier file.
|
|When you aggregate records together, different fields have differing merge
|algorithms.  Tcprtt does not survive this type of merging, so it goes to zero.
|
|Interpacket arrival times and jitter (which is really stddev (sqr root of
|jitter) are
|in microseconds.  intpkt, sintpkt, dintpkt, sintpktact, dintpktact, sintpktidl
|and
|dintpktidl are means of interpacket arrival times during the observation
|period.
|The sjit, djit, sjitact, djitact, sjitidl, djitidl, are standard deviations for
|the means.
|Jitter is reported as a stddev, so that it can be at the same relative scale as
|the
|mean.  When reporting variance on numbers that are very large or small, the
|numbers get really out there really quickly, so I'm reporting the square root
|of
|the variance.  The number of packets - 1 is the N of the mean and std dev.
|
|When you merge records, these interpacket arrival times and std deviations
|are all merged correctly, ie you get the mean of the means, and we do a good
|job of getting the std devs merged (recover the sums of squares, accumulate
|them from the two records that are being merged, and then recalculate a std
|dev).
|
|Carter
|
|
|
|On Mar 15, 2007, at 7:40 PM, Michael Hornung wrote:
|
|> Any ideas about the units reported by the srate, drate, sjit, djit fields?
|> 
|> -Mike
|> 
|> ---------- Forwarded message ----------
|> Date: Wed, 14 Mar 2007 09:29:50 -0700 (PDT)
|> From: Michael Hornung <hornung at cac.washington.edu>
|> To: argus-info at lists.andrew.cmu.edu
|> Subject: help understand output
|> 
|> Hi, I'm trying to absorb some argus results I'm seeing and I would love any
|> feedback you care to offer.  I'm trying to generate network performance stats
|> for the roughly 5 minute window encompassed by a given argus file.
|> 
|> The filename is 1173830402 and indicates the timestamp when the argus file
|> was archived.  The pipeline I've chosen is:
|> 
|> racluster -M rmon -r 1173830402 -w - |   \
|> rasort -r - -w - -m pkts - 'src net X.Y.0.0/16 or src net X.Y.0.0/16' |  \
|> ra -r - -s saddr stime dur srate drate pkts sloss dloss sjit djit tcprtt -
|> 
|> What I'm attempting to do with the above is aggregate the flows from the one
|> file using 'racluster', then use 'rasort' to sort the output stream by number
|> of total flow packets and limit results to flows with source IP on the
|> networks I'm examining, then lastly to use 'ra' to print the values I think
|> are interesting.  First off, is what I've done a reasonable way to get these
|> deetails for every flow in the file?
|> 
|> Here are the first few lines of output, and I have some questions below that:
|> 
|>     X.Y.41.50    15:55:35.565814 265.849501   107619.148  4909709.500 166922
|> 0        717     9657.000     7612.128     0.000000
|> 
|>     X.Y.59.54    15:55:35.528842 266.161310  2766199.500    81832.180 105633
|> 816         64    15169.226    17774.765     0.000000
|> 
|>    X.Y.39.244    15:55:35.562186 264.461433    66525.547  2836946.000 104869
|> 0        386    38966.000    28543.830     0.000000
|> 
|>     X.Y.40.15    15:55:35.529837 266.712496    77486.641  2527835.250 94988 1
|> 1107    26946.000    19721.859     0.000000
|> 
|>     X.Y.117.8    15:55:35.590168 181.982163    76109.609  3445644.000 80115 0
|> 342    37715.000    28914.062     0.000000
|> 
|>     X.Y.26.112    15:55:35.593296 262.440843  1409295.625   103432.859 70112
|> 38        189    79309.000    46967.357     0.000000
|> 
|>     X.Y.40.91    15:55:35.597797 265.680459    52282.656  1952823.500 68964 0
|> 300    16701.000    15050.079     0.000000
|> 
|>      X.Y.61.3    15:55:35.558065 266.818069    44189.512  1537505.000 60578 0
|> 310    32309.000    24219.612     0.000000
|> 
|>    X.Y.45.125    15:55:35.569448 266.890136    41935.457  1511283.125 58026 0
|> 258    26755.000    22366.359     0.000000
|> 
|>    X.Y.38.232    15:55:35.574330 265.466687   289928.406   538903.688 55949 0
|> 0    13978.000    12320.000
|> 
|>   X.Y.115.165    15:55:35.531332 265.404640  1517963.000    35730.168 54641
|> 70         27    18501.262    22818.404     0.000000
|> 
|>    X.Y.115.57    15:55:35.396544 266.015024  1459115.750    45962.309 54044
|> 231          2    21290.250    24470.000     0.000000
|> 
|> Questions:
|> 
|> How can the source packet rate (column 4) and destination packet rate (column
|> 5) be higher than the total number of packets for the given flow (column 6)?
|> 
|> Why does the third record from the bottom have nothing in the tcprtt (last)
|> column?
|> 
|> Can I safely assume that the tcprtt for all the other records here is
|> 0.000000 because the TCP sessions were not *established* during the window
|> I'm reporting on?
|> 
|> What are the units for the sjit and djit (jitter) fields?  They look too big
|> to be milliseconds.
|> 
|> Are sjit and djit reporting the average for a given flow, or how is the
|> jitter being characterized?
|> 
|> Thanks so much to those that can offer info.
|> 
|> -Mike
|> 
|