Nondeterministic output
George Jones
fooologist at gmail.com
Tue Sep 21 11:05:00 EDT 2010
The following command produces different output:
cat foo.pcap | argus -U 64 -r - -w /tmp/foo.ar
cat foo.pcap | argus -U 64 -r - -w /tmp/bar.ar
cksum(1) shows the content differs (but byte count is the same).
More disturbing is different numbers of records output from identical runs
on the same input, etc.
cat foo.pcap | argus -U 64 -r - -w - | racluster -r - -w - | ra -r - | tee
/tmp/1.out
cat foo.pcap | argus -U 64 -r - -w - | racluster -r - -w - | ra -r - | tee
/tmp/2.out
results in slightly different output. Sometimes there are slight
differences in the flgs (packet ordering, I think),
but in a file of several thousand records, I'm getting 6 or so additional
records in one output file vs the other.
Confused,
---George Jones
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100921/e71c4257/attachment.html>
More information about the argus
mailing list