Flow loss metric

[Carter Bullard]

Hey Pablo,
Sorry for the delayed response.
Seems that the unique loopback flow, where the src and destination
Layer 2 and Layer 3 addresses are all the same, in conjunction with
libpcap apparently not delivering packets in true time order from the
loopback interface, may be confusing the retransmission/loss metric,
but that is just a a guess.

I'll try to look at this today.  Thanks for the packets, that will help a great deal!!!!

Carter

On Apr 10, 2010, at 9:18 AM, Pablo J. Rebollo-Sosa wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> I was using Argus to determine traffic loss and noticed odd results.  To
> recreate the scenario a file was transfered trough the loopback and
> captured with tshark.  Then the dump was analyzed with argus with the
> following results:
> 
>> argus -X -r tsharkcapture-lo -w - | ra -n -L 1 -s saddr sport dir daddr dport pkts spkts dpkts loss sloss dloss ploss
>>           SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts  SrcPkts  DstPkts       Loss    SrcLoss    DstLoss    pLoss 
>>         127.0.0.1.46929     ->          127.0.0.1.80           58       28       30         54         26         28 48.21428
> 
> I can't understand that 58 packets were captured and 54 of them were
> lost.  There is something wrong?
> 
> Attached is the captured file.
> 
> Best regards,
> 
> Pablo J. Rebollo-Sosa
> 
> - ---
> Argus Version 3.0.3.3
> Ra Version 3.0.3.6
> 
> Serve the file
> mini-httpd -d ARGUS/
> 
> Loopback capture
> tshark -s 0 -i lo -w tsharkcapture-lo
> 
> Download file
> wget http://127.0.0.1/argus-3.0.3.3.tar.gz
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> 
> iEYEARECAAYFAkvAeq4ACgkQxjU5UYZ6K6fa4wCfeyp+D4ySDSE3fSBiGeyoOzRj
> sNkAn2aMfyuSIKIydHbiWHfJI/TuF2aV
> =37gf
> -----END PGP SIGNATURE-----
> <tsharkcapture-lo>

Carter Bullard
CEO/President
QoSient, LLC
150 E 57th Street Suite 12D
New York, New York  10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100416/0e9b2e5e/attachment.bin>