Racluster discarding packet loss data

[Carter Bullard]

Hey Bart,
It could be that the software on the server is newer than the one you used.
Give the clients a try if have any time.
Carter

On Jan 28, 2010, at 4:21 PM, Bart Roos wrote:

> Hi Carter,
> 
> I was already using the 3.0.2 server and client when I reported the bug, so it is definitely still present in the current release. If you could fix it in the upcoming release, that would be great.
> 
> Thanks,
> Bart
> 
> On 1/28/10 6:46 PM, Carter Bullard wrote:
>> Hey Bart,
>> Thanks for reminding me!!!   Yes I believe that it is fixed in the argus-clients-3.0.2
>> that is the official release.  Its on the server, you can grab it from:
>>    http://qosient.com/argus
>> 
>>  If you try it out, and its not working, holler.  I'll fix it in
>> argus-clients-3.0.3.1, which I will upload early next week.
>> 
>> Carter
>> 
>> On Jan 28, 2010, at 11:51 AM, Bart Roos wrote:
>> 
>>> Hi Carter,
>>> 
>>> Did you already manage to fix this particular bug?
>>> 
>>> Thanks,
>>> Bart
>>> 
>>> -----Original Message-----
>>> From: argus-info-bounces+roos=fox-it.com at lists.andrew.cmu.edu [mailto:argus-info-bounces+roos=fox-it.com at lists.andrew.cmu.edu] On Behalf Of Carter Bullard
>>> Sent: maandag 14 december 2009 16:12
>>> To: Bart Roos
>>> Cc: argus-info at lists.andrew.cmu.edu
>>> Subject: Re: [ARGUS] Racluster discarding packet loss data
>>> 
>>> Hey Bart,
>>> Looks like we've got a bug and I don't have a fix yet, but I do have a
>>> potential work around for you.
>>> 
>>> If you run racluster() using default parameters before running
>>> racluster()
>>> with the flow key modificatons, you'll get loss back (at least for
>>> this file).
>>> 
>>>    racluster -w -  -r argus.log* | racluster -s +loss -m proto saddr
>>> 
>>> There are 3 types of TCP DSR's, and it maybe that the bug is in dealing
>>> with the loss stats when merging with a TCP matching flow that uses
>>> a different TCP DSR (that doesn't have loss stats).
>>> 
>>> Try this work around, and I'll look for a fix later today,
>>> 
>>> Carter
>>> 
>>> On Dec 13, 2009, at 8:04 AM, Bart Roos wrote:
>>> 
>>>> Hello everyone,
>>>> 
>>>> I am trying to collect packet loss data for a particular host in a LAN
>>>> segment using the following racluster command:
>>>> 
>>>> $ racluster -r argus.log -m saddr -s loss - tcp and src host
>>>> 10.10.0.12
>>>>        0
>>>> 
>>>> The racluster output does not report any packet loss, but counting the
>>>> packet loss from individual argus records does show some loss:
>>>> 
>>>> $ ra -r argus.log -s loss - tcp and src host 10.10.0.12 | \
>>>> awk '{c+=$1;} END {print c;}'
>>>> 217
>>>> 
>>>> Why is racluster discarding the packet loss data? Is this a bug, or
>>>> am I
>>>> doing something wrong? I'm running the 3.0.2 server and clients.
>>>> 
>>>> Thanks,
>>>> Bart
>>>> 
>>> 
>>> 
>> 
>> Carter Bullard
>> CEO/President
>> QoSient, LLC
>> 150 E 57th Street Suite 12D
>> New York, New York  10022
>> 
>> +1 212 588-9133 Phone
>> +1 212 588-9134 Fax
>> 
>> 
>> 
> 
> 

Carter Bullard
CEO/President
QoSient, LLC
150 E 57th Street Suite 12D
New York, New York  10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100128/f447f325/attachment.bin>