Time Issue on OpenBSD 4.2 with rc.69 (Was: Re: Sparc64 OpenBSD4.1 Compile issue)
Peter Van Epp
vanepp at sfu.ca
Mon Feb 11 16:20:54 EST 2008
For me OpenBSD 4.2 (without Eric's patches) works to FreeBSD with \
sockets too (once I got the config right):
OpenBSD (32 bit Intel)
argus -B 142.58.1.235 -P 560 -i rl0
FreeBSD (32 bit Intel)
ra3 -S 142.58.1.235:560 -n -w argus.test
%ra3 -r argus.test -n
08-02-11 04:52:07 e udp fe80::21d:4fff:fe*.5353 -> ff02::fb.5353 1 297 INT
08-02-11 04:52:07 e udp 169.254.107.57.137 -> 169.254.255.255.137 3 276 INT
08-02-11 04:52:08 e arp 142.58.1.231 who 142.58.1.34 1 64 INT
08-02-11 04:52:09 e arp 142.58.2.254 who 142.58.2.51 2 120 INT
08-02-11 04:52:09 * llc 0:11:88:47:e0:ed.66 -> 1:80:c2:0:0:0.66 2 238 INT
I guess next step here is add Eric's patch (to fix ratop) and see if
that breaks things, and see if I can get clients to compile on Solaris (and
see if our main timeshare host is 64 bit Sparc, I think it is).
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
On Mon, Feb 11, 2008 at 04:11:01PM -0500, Carter Bullard wrote:
> Hmmm, a bit more confusing. So lets enumerate what we've got working
> and what doesn't with regard to timestamps:
>
> sparc64 argus -> sparc64 ra - bad timestamps
> sparc64 argus -> file -> sparc64 ra - bad timestamps
>
> i386 argus -> i386 ra - bad timestamps ?
> i386 argus -> file -> i386 ra - good timestamps
>
> and then a follow up test would be:
> i386 argus -> file -> sparc64 ra - bad timestamps ?
> sparc64 argus -> file -> i386 ra - bad timestamps ?
>
>
> Carter
>
>
> On Feb 11, 2008, at 3:12 PM, Eric Pancer wrote:
>
> >On Mon, 2008-02-11 at 11:46:19 -0800, Peter Van Epp proclaimed...
> >
> >> Local seems to work fine which may point to the socket code:
> >>
> >># argus -d -i rl0 -w test.argus
> >># ra -r test.argus -n
> >
> >[snip]
> >
> >>time is wrong but thats the machine :-) and I don't have Eric's
> >>patches in so
> >>ratop didn't build (but ra appears to have).
> >>
> >
> >Yes, we have good time from the file here too! (i386)
> >
> >ra -nr foo.cap <
> >2008-02-11 14:08:1 * llc 0:d:29:4b:c:26.66 ->
> >1:80:c2:0:0:0.66 60 3720 INT
> >2008-02-11 14:08:2 e tcp 10.154.223.177.22 <?>
> >10.154.223.223.3737 24 2520 CON
> >2008-02-11 14:08:2 e d tcp 10.154.223.223.2324 <?>
> >10.154.223.177.22 408 43104 CON
> >2008-02-11 14:08:2 e udp 10.154.223.3.1985 ->
> >224.0.0.2.1985 13 806 INT
> >2008-02-11 14:08:2 e udp 10.154.223.2.1985 ->
> >224.0.0.2.1985 13 806 INT
> >2008-02-11 14:08:2 * udp 10.154.198.3.1985 ->
> >224.0.0.2.1985 14 924 INT
> >2008-02-11 14:08:2 * udp 10.154.198.2.1985 ->
> >224.0.0.2.1985 14 924 INT
> >2008-02-11 14:08:2 e tcp 10.154.223.177.18056 <?>
> >10.152.23.39.80 4 264 FIN
> >2008-02-11 14:08:2 e tcp 10.154.223.177.9491 <?>
> >10.152.23.39.80 4 264 FIN
> >2008-02-11 14:08:2 * arp 10.154.198.3 who
> >10.154.198.16 9 576 INT
> >2008-02-11 14:08:3 e tcp 10.154.223.177.18368 <?>
> >10.154.215.170.80 4 264 FIN
> >2008-02-11 14:08:3 e tcp 10.154.223.177.1491 <?>
> >10.154.215.170.80 4 264 FIN
> >2008-02-11 14:08:3 e d tcp 10.154.223.177.26935 ->
> >10.154.215.170.80 43 23269 FIN
> >2008-02-11 14:08:3 e udp 10.154.223.177.20331 <->
> >10.152.23.12.53 2 221 CON
> >2008-02-11 14:08:3 e udp 10.154.223.177.33705 <->
> >10.152.23.12.53 2 335 CON
> >2008-02-11 14:08:3 e d tcp 10.154.223.177.35005 ->
> >10.154.215.170.80 23 12253 FIN
> >2008-02-11 14:08:3 e d tcp 10.154.223.177.25924 ->
> >
> >
> >How about sparc64?
> >
> >$ date
> >Mon Feb 11 14:10:30 CST 2008
> >$ ra -nr foo.cap
> >1970-01-08 01:18:2 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 60 CON
> >1970-01-10 02:52:1 * llc 0:d:29:4b:c:25.66 ->
> >1:80:c2:0:0:0.66 1 60 INT
> >1970-01-10 04:43:0 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 106 CON
> >1970-01-10 04:56:2 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-11 14:44:3 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 60 CON
> >1970-01-01 02:55:5 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 106 CON
> >1970-01-01 03:08:2 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-01 03:12:0 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-01 03:15:3 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 60 CON
> >1970-01-01 19:18:1 e udp 10.154.223.2.1985 ->
> >224.0.0.2.1985 1 62 INT
> >1970-01-02 21:08:4 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 106 CON
> >1970-01-02 21:21:5 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-02 21:25:2 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-02 21:28:4 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 60 CON
> >1970-01-04 10:54:3 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 106 CON
> >1970-01-04 11:07:1 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-04 11:10:4 e tcp 10.154.223.28.22 ?>
> >10.154.223.223.3953 1 106 CON
> >1970-01-04 11:13:5 e tcp 10.154.223.223.3953 ?>
> >10.154.223.28.22 1 60 CON
> >
> >Damn, no go there.
> >
> >So, taking flows from a file on i386 gives good time, but using
> >sockets to
> >i386 or sparc64 doesn't work. Taking flows from a file on sparc64
> >doesn't
> >give good time, nor does it in taking flows from i386 or sparc64.
> >
> >- Eric
> >
>
More information about the argus
mailing list