Argus on Bivio 7500

Tue Aug 4 17:53:09 EDT 2009

Hey Carter,
Good news!! It works!
I've attached the Bivio-style init scripts and NRSP profiles I created.
Inside the tarball is a readme too, for those not familiar with Bivio's
examples (which I used to create these)
When started with NRSP, a separate argus process will be spawned for each
loadshared CPU installed, and will listen for connections.
When started with NRSP (and the included radium.conf), radium will combine
all the CPUs' data together into one feed, which can be accessed locally on
CPU-X or the mgt0 management interface.
Of course, our Bivio boxes only have 2x 2-core CPUs, so if you have the
expansion module, you'll need to change radium.conf or you'll be missing
some traffic.

Feel free to include these in the support directory if you want.

Thanks again for your help!
Eric

On Fri, Jul 31, 2009 at 11:24 AM, Eric Gustafson <subwire at gmail.com> wrote:

> Hey Carter,
> I'm happy to test those Bivio-related mods for you any time.  Just let me
> know.
>
> rasplit is holding up fine with our script that restarts it every time the
> argus daemon notices it disconnect.
> I'll check out those fixes and get back to you on that though!
>
> Thanks!
> - Eric
>
>
> On Mon, Jul 27, 2009 at 7:17 AM, Carter Bullard <carter at qosient.com>wrote:
>
>> Hey Guys,
>> I'd like to work on specific Bivio mods for argus-3.0.2 this week.  I've
>> got most of the code
>> structured to conditionally not use pcap_next_ex now, is there a chance we
>> can test
>> it out sometime this week or next?
>>
>> Eric, how has your rasplit() held up?  There were very specific rasplit()
>> mods in some of
>> the recent updates, did you get a chance to grab new code and try them
>> out?
>>
>> Thanks for all the help!!!
>>
>> Carter
>>
>>
>> On Jun 22, 2009, at 9:39 PM, Jason Carr wrote:
>>
>>  Hi Eric,
>>>
>>> We also had the same problem compiling the 3.x series on our Bivio units.
>>>  Bivio ships (even with the newest OS 5.0.5) with an older libpcap.  We were
>>> told that the new libpcap that implements the pcap_get_selectable_fd method
>>> is in beta and should be released with the next OS release.
>>>
>>> Right now we're running argus 2.x and running rastream 3.x on a non-Bivio
>>> machine.  The 2.x series compiles just fine (but no IPv6).
>>>
>>> This was before Carter implemented any sort of Bivio changes, so I have
>>> not tested those.
>>>
>>> Let me know if you have any questions.  I'm also interested in what else
>>> you might be using your Bivio for.
>>>
>>> - Jason
>>>
>>>
>>> On Jun 22, 2009, at 4:49 PM, Eric Gustafson wrote:
>>>
>>>  Hi Carter et al,
>>>> I'm trying to compile the latest test argus (3.0.2 beta8) on one of our
>>>> Bivio 7500s, and am running into linking trouble.
>>>>
>>>> gcc -O3 -I.  -I./../include  -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\"
>>>> -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\"
>>>> -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1
>>>> -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1
>>>> -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_STRING_H=1 -DHAVE_FCNTL_H=1
>>>> -DHAVE_SYS_FILE_H=1 -DHAVE_SYSLOG_H=1 -DHAVE_SYS_VFS_H=1 -DHAVE_VFPRINTF=1
>>>> -DHAVE_STRCASECMP=1 -DHAVE_STRDUP=1 -DHAVE_STRFTIME=1 -DHAVE_SETLINEBUF=1
>>>> -DHAVE_ALARM=1 -DHAVE_STRERROR=1 -DHAVE_STRTOF=1 -DHAVE_SYS_BITYPES_H=1
>>>> -DHAVE_INTTYPES_H=1 -DHAVE_VSNPRINTF=1 -DHAVE_SNPRINTF=1
>>>> -DHAVE_GETADDRINFO=1 -DHAVE_ETHER_HOSTTON=1 -DHAVE_NETINET_ETHER_H=1
>>>> -DNETINET_ETHER_H_DECLARES_ETHER_HOSTTON= -DHAVE_DECL_ETHER_HOSTTON=1
>>>> -D_FILE_OFFSET_BITS=64 -DHAVE_TCP_WRAPPER=1 -DLBL_ALIGN=1 -DSTDC_HEADERS=1
>>>> -DARGUS_SYSLOG=1 -o ../bin/argus argus.o ArgusModeler.o ArgusSource.o
>>>> ArgusUtil.o ArgusOutput.o ArgusUdp.o ArgusTcp.o ArgusIcmp.o ArgusIgmp.o
>>>> ArgusEsp.o ArgusArp.o ArgusFrag.o ArgusAuth.o ArgusApp.o  ../lib/libpcap.a
>>>> -lwrap -lnsl  ../lib/argus_common.a -lm
>>>> ArgusSource.o: In function
>>>> `ArgusGetPackets':ArgusSource.c:(.text+0x2cf8): undefined reference to
>>>> `pcap_get_selectable_fd'
>>>> :ArgusSource.c:(.text+0x2d90): undefined reference to `pcap_next_ex'
>>>> :ArgusSource.c:(.text+0x2dcc): undefined reference to `pcap_next_ex'
>>>> :ArgusSource.c:(.text+0x2e08): undefined reference to `pcap_next_ex'
>>>> :ArgusSource.c:(.text+0x2e44): undefined reference to `pcap_next_ex'
>>>> :ArgusSource.c:(.text+0x2eac): undefined reference to `pcap_next_ex'
>>>> ArgusSource.o:ArgusSource.c:(.text+0x2ec8): more undefined references to
>>>> `pcap_next_ex' follow
>>>> collect2: ld returned 1 exit status
>>>> make[1]: *** [../bin/argus] Error 1
>>>> make[1]: Leaving directory `/bivio/shared/root/argus-3.0.1.beta.3/argus'
>>>> ### Done with /root/argus-3.0.1.beta.3/argus
>>>>
>>>> I configured with --with-libpcap=/usr/lib/zcp/, which is where Bivio
>>>> stashes its special version of libpcap.
>>>> I noticed your mention of "changes to support Bivio hardware" for this
>>>> release, but I didn't see any instructions regarding extra steps to get it
>>>> to work.
>>>> Any ideas?
>>>>
>>>> Thanks so much,
>>>> Eric
>>>>
>>>
>>>
>>>
>> Carter Bullard
>> CEO/President
>> QoSient, LLC
>> 150 E 57th Street Suite 12D
>> New York, New York  10022
>>
>> +1 212 588-9133 Phone
>> +1 212 588-9134 Fax
>>
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090804/630a8d47/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: argus-bivio-support-files.tar.gz
Type: application/x-gzip
Size: 5178 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090804/630a8d47/attachment.bin>