Argus giving wrong bytes results ?

[Dave Edelman]

-----Original Message-----
From: argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu
[mailto:argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu] On
Behalf Of Peter Van Epp
Sent: Sunday, June 06, 2010 2:51 PM
To: argus-info at lists.andrew.cmu.edu
Subject: Re: [ARGUS] Argus giving wrong bytes results ?

On Sun, Jun 06, 2010 at 09:31:42AM +0200, Reykjavik hindisvik wrote:
> Hello,
> 
> I would like to use argus to draw graph of bandwidth usage for our
network.
> Today, I'm using SNMP which give me a graph of my bandwidth, and I've
setup
> Argus which draw the same graph for the same Network Interface but does
not
> give me the same results at all...
> 
> I can't believe it's a bug but I bet it's just a different way to get the
> packets and maybe there's an option to get the same results as I have with
> SNMP.
> 
> For example : When I download a 130Mb File, SNMP show me 130MB, but Argus
> show me much more (maybe be it includes size of header or something that
> SNMP don't...) and for me the result in the right.
> So my question is :
> 
> 1) What does exactly makes the difference ?

    Without knowing what the SNMP is reading we can't be sure, but by 
default argus will display traffic on the wire including headers and 
tcp retransmissions. That actually gives you a better idea of the actual
traffic on your network than just good put, but good put is available if 
desired.

> 2) Is there a way to get the same results (option or something...)

    Assuming SNMP is only displaying application bytes and you are using
ra to get the counts, then the option -s +appbytes 
(or -s +sappbytes -s +dappbytes if you want both ways rather than a total)
will give you only the application bytes supressing headers and
retransmitted
packets (although as noted this gives you a distorted picture of the actual
busyness of your network). If you are using one of the aggregators you
should
be able to choose appbytes as the aggregation field. You may need to put a 
field length on the output if the counts are large (the ra man page has 
details). 

> 3) Maybe I can recount it after with a math formula to get the same
results,
> but which formula ?

    You can but its somewhat difficult in that you need to know the 
header sizes and retransmit rate. It wiil be much easier and probably more
accurate to use appbytes though. 
> 
> Thanx for your ideas.
> 
> Best regards,
> 
> H.

Peter Van Epp

---------------------------Attempting not to top post and Peter beat me to
the in-line reply -------------------


I actually would have thought that the number would be the same or that if
there was a difference, that the SNMP results would have shown the larger
value.

Which MIB variable are you using to determine the number of bytes that are
being transferred? In most instances, you need to read a value, do the
transfer, and read the same value to calculate the difference. Again,
depending on the MIB variable you may be looking at inOctets or outOctets or
maybe you are only looking at one of the two so you are seeing only part of
the story with SNMP. 

If you can provide a few more details on how you are doing the two
measurements, I'm sure that someone here can help.

--Dave