Nondeterministic output

George Jones fooologist at gmail.com
Tue Sep 21 11:05:00 EDT 2010


The following command produces different output:

  cat foo.pcap | argus -U 64 -r - -w /tmp/foo.ar
  cat foo.pcap | argus -U 64 -r - -w /tmp/bar.ar

cksum(1) shows the content differs (but byte count is the same).

More disturbing is different numbers of records output from identical runs
on the same input, etc.

  cat foo.pcap | argus -U 64 -r - -w - | racluster -r - -w - | ra -r - | tee
/tmp/1.out
  cat foo.pcap | argus -U 64 -r - -w - | racluster -r - -w - | ra -r - | tee
/tmp/2.out

results in slightly different output.  Sometimes there are slight
differences in the flgs (packet ordering, I think),
but in a file of several thousand records, I'm getting 6 or so additional
records in one output file vs the other.

Confused,
---George Jones
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100921/e71c4257/attachment.html>


More information about the argus mailing list