ArgusInterface timestamps wayyy out of order

[Peter Van Epp]

On Sun, Apr 13, 2008 at 10:44:18AM -0400, Harry Hoffman wrote:
> Hi,
> 
> So, I just setup a fbsd 7.0 box (ibm x335 dual PIV/2GB RAM/2x73GB HDs).
> The box is ntp sync'd and I've got two 1GB fiber cards, setup as a
> netgraph device, going into a NetOptics tap that sits in btwn our border
> router.
> 
> Argus keeps dying in daemon mode so I ran it in the foreground and see
> the following errors:
> 
>   ArgusWarning: argus[11889]: 12 Apr 08 21:59:10.100962 started
>   ArgusWarning: argus[11889]: 12 Apr 08 21:59:10.101208
> ArgusGetInterfaceStatus: interface ngeth0 is up
>   ArgusWarning: argus[11889]: 12 Apr 08 22:03:38.881062 ArgusInterface
> timestamps wayyy out of order: now -93781688 then 1208052218
>   ArgusWarning: argus[11889]: 12 Apr 08 22:04:35.004380 ArgusInterface
> timestamps wayyy out of order: now 845807944 then 1208052274
>   ArgusWarning: argus[11889]: 12 Apr 08 22:08:08.653032 ArgusInterface
> timestamps wayyy out of order: now 141230408 then 1208052488
>   ArgusWarning: argus[11889]: 12 Apr 08 22:10:27.178813 ArgusInterface
> timestamps wayyy out of order: now -1821703864 then 1208052627
>   ArgusWarning: argus[11889]: 12 Apr 08 22:12:47.256416 ArgusInterface
> timestamps wayyy out of order: now 527171912 then 1208052767
>   ArgusWarning: argus[11889]: 12 Apr 08 22:14:31.224113 ArgusInterface
> timestamps wayyy out of order: now -2022964920 then 1208052871
> 
> Google isn't being much help on this one. Any pointers as how to fix
> this?
> 
> Cheers,
> Harry
> 
> 

	Check that you have disabled Interrupt throttling on the NICs. If it
is on then many packets will get the same timestamp (that of when the interrupt
occurred and it processed the entire buffer at once). I'd guess that will do 
bad things to the timestamps and may cause this. 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada