Time Issue on OpenBSD 4.2 with rc.69 (Was: Re: Sparc64 OpenBSD4.1 Compile issue)

Peter Van Epp vanepp at sfu.ca
Mon Feb 11 16:20:54 EST 2008


	For me OpenBSD 4.2 (without Eric's patches) works to FreeBSD with \
sockets too (once I got the config right):

OpenBSD (32 bit Intel)

argus -B 142.58.1.235 -P 560 -i rl0

FreeBSD (32 bit Intel)

ra3 -S 142.58.1.235:560 -n -w argus.test

%ra3 -r argus.test -n
 08-02-11 04:52:07  e         udp fe80::21d:4fff:fe*.5353      ->           ff02::fb.5353          1        297   INT
 08-02-11 04:52:07  e         udp     169.254.107.57.137       ->    169.254.255.255.137           3        276   INT
 08-02-11 04:52:08  e         arp       142.58.1.231          who        142.58.1.34               1         64   INT
 08-02-11 04:52:09  e         arp       142.58.2.254          who        142.58.2.51               2        120   INT
 08-02-11 04:52:09  *         llc   0:11:88:47:e0:ed.66        ->      1:80:c2:0:0:0.66            2        238   INT

	I guess next step here is add Eric's patch (to fix ratop) and see if 
that breaks things, and see if I can get clients to compile on Solaris (and
see if our main timeshare host is 64 bit Sparc, I think it is). 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Mon, Feb 11, 2008 at 04:11:01PM -0500, Carter Bullard wrote:
> Hmmm, a bit more confusing.  So lets enumerate what we've got working
> and what doesn't with regard to timestamps:
> 
>    sparc64 argus ->                sparc64 ra -  bad timestamps
>    sparc64 argus ->    file     -> sparc64 ra -  bad timestamps
> 
>    i386 argus    ->                i386 ra    -  bad timestamps ?
>    i386 argus    ->    file     -> i386 ra    - good timestamps
> 
> and then a follow up test would be:
>    i386 argus    ->    file     -> sparc64 ra -  bad timestamps ?
>    sparc64 argus ->    file     -> i386 ra    -  bad timestamps ?
> 
> 
> Carter
> 
> 
> On Feb 11, 2008, at 3:12 PM, Eric Pancer wrote:
> 
> >On Mon, 2008-02-11 at 11:46:19 -0800, Peter Van Epp proclaimed...
> >
> >>	Local seems to work fine which may point to the socket code:
> >>
> >># argus -d -i rl0 -w test.argus
> >># ra -r test.argus -n
> >
> >[snip]
> >
> >>time is wrong but thats the machine :-) and I don't have Eric's  
> >>patches in so
> >>ratop didn't build (but ra appears to have).
> >>
> >
> >Yes, we have good time from the file here too! (i386)
> >
> >ra -nr foo.cap                                             <
> >2008-02-11 14:08:1  *         llc     0:d:29:4b:c:26.66        ->  
> >1:80:c2:0:0:0.66           60       3720   INT
> >2008-02-11 14:08:2  e         tcp    10.154.223.177.22       <?>  
> >10.154.223.223.3737         24       2520   CON
> >2008-02-11 14:08:2  e d       tcp    10.154.223.223.2324     <?>  
> >10.154.223.177.22          408      43104   CON
> >2008-02-11 14:08:2  e         udp      10.154.223.3.1985      ->  
> >224.0.0.2.1985         13        806   INT
> >2008-02-11 14:08:2  e         udp      10.154.223.2.1985      ->  
> >224.0.0.2.1985         13        806   INT
> >2008-02-11 14:08:2  *         udp      10.154.198.3.1985      ->  
> >224.0.0.2.1985         14        924   INT
> >2008-02-11 14:08:2  *         udp      10.154.198.2.1985      ->  
> >224.0.0.2.1985         14        924   INT
> >2008-02-11 14:08:2  e         tcp    10.154.223.177.18056    <?>  
> >10.152.23.39.80            4        264   FIN
> >2008-02-11 14:08:2  e         tcp    10.154.223.177.9491     <?>  
> >10.152.23.39.80            4        264   FIN
> >2008-02-11 14:08:2  *         arp      10.154.198.3          who  
> >10.154.198.16               9        576   INT
> >2008-02-11 14:08:3  e         tcp    10.154.223.177.18368    <?>  
> >10.154.215.170.80            4        264   FIN
> >2008-02-11 14:08:3  e         tcp    10.154.223.177.1491     <?>  
> >10.154.215.170.80            4        264   FIN
> >2008-02-11 14:08:3  e d       tcp    10.154.223.177.26935     ->  
> >10.154.215.170.80           43      23269   FIN
> >2008-02-11 14:08:3  e         udp    10.154.223.177.20331    <->  
> >10.152.23.12.53            2        221   CON
> >2008-02-11 14:08:3  e         udp    10.154.223.177.33705    <->  
> >10.152.23.12.53            2        335   CON
> >2008-02-11 14:08:3  e d       tcp    10.154.223.177.35005     ->  
> >10.154.215.170.80           23      12253   FIN
> >2008-02-11 14:08:3  e d       tcp    10.154.223.177.25924     ->
> >
> >
> >How about sparc64?
> >
> >$ date
> >Mon Feb 11 14:10:30 CST 2008
> >$ ra -nr foo.cap
> >1970-01-08 01:18:2  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1         60   CON
> >1970-01-10 02:52:1  *         llc     0:d:29:4b:c:25.66        ->  
> >1:80:c2:0:0:0.66            1         60   INT
> >1970-01-10 04:43:0  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1        106   CON
> >1970-01-10 04:56:2  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-11 14:44:3  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1         60   CON
> >1970-01-01 02:55:5  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1        106   CON
> >1970-01-01 03:08:2  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-01 03:12:0  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-01 03:15:3  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1         60   CON
> >1970-01-01 19:18:1  e         udp      10.154.223.2.1985      ->  
> >224.0.0.2.1985          1         62   INT
> >1970-01-02 21:08:4  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1        106   CON
> >1970-01-02 21:21:5  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-02 21:25:2  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-02 21:28:4  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1         60   CON
> >1970-01-04 10:54:3  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1        106   CON
> >1970-01-04 11:07:1  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-04 11:10:4  e         tcp     10.154.223.28.22        ?>  
> >10.154.223.223.3953          1        106   CON
> >1970-01-04 11:13:5  e         tcp    10.154.223.223.3953      ?>  
> >10.154.223.28.22            1         60   CON
> >
> >Damn, no go there.
> >
> >So, taking flows from a file on i386 gives good time, but using  
> >sockets to
> >i386 or sparc64 doesn't work. Taking flows from a file on sparc64  
> >doesn't
> >give good time, nor does it in taking flows from i386 or sparc64.
> >
> >- Eric
> >
> 



More information about the argus mailing list