ra: window difference ?
carter at qosient.com
Thu Dec 10 11:36:14 EST 2009
In the file you uploaded, 131803 of the flows that are reporting source windows of
zero are flows that are simple single packet flows, so you and I are getting consistent
numbers, so I suspect that your numbers are real.
I can't explain the discrepancy, as I have looked at the code and your sample
file and there shouldn't be a problem. With the numbers switched, you should be
able to find a packet in your file where wireshark thinks there is a window number,
and the resulting argus record reports zero.
If you could create a packet file that has a packet or two that wireshark thinks
has a src window value but argus reports as zero, then I can debug.
On Dec 9, 2009, at 5:02 PM, julien wrote:
> Carter Bullard wrote on 09/12/09 19:40:
>> What filter(s) are you using to generate your numbers?
> here for wireshark
>>> Why Wireshark would return 9% of packets with size 0 and the others with 0 (filter with tcp.windows_space == 0 or n)
>>> and Argus returns 84% of flows with size 0 and the others with size 0 ? (with ra)
> and for argus, I make a chart with data from the following command:
> ra -n -s swin -r $src_log
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 3815 bytes
Desc: not available
More information about the argus