Duration sum bug

Mon Mar 21 13:26:01 EDT 2011

racluster -r <files> -s stime ltime dur trans mean saddr dir daddr
spkts dpkts - host 1.2.3.4 produces:

03:57:23.529664    03:57:23.544301   0.014637      1   0.014637
5.6.7.5   <->            1.2.3.4        1        1
09:57:27.624699    09:57:27.639307   0.014608      1   0.014608
5.6.7.5   <->            1.2.3.4        1        1
12:57:29.660667    12:57:29.676479   0.015812      1   0.015812
5.6.7.5   <->            1.2.3.4        1        1
13:57:30.339190    13:57:30.354246   0.015056      1   0.015056
5.6.7.5   <->            1.2.3.4        1        1
14:57:31.030849    14:57:31.046388   0.015539      1   0.015539
5.6.7.5   <->            1.2.3.4        1        1
16:57:32.385680    16:57:32.400769   0.015089      1   0.015089
5.6.7.5   <->            1.2.3.4        1        1
18:57:33.772816    18:57:33.788103   0.015287      1   0.015287
5.6.7.5   <->            1.2.3.4        1        1
20:57:18.761336    20:57:18.776750   0.015414      1   0.015414
5.6.7.5   <->            1.2.3.4        1        1
20:57:18.793793    20:57:18.808984   0.015191      1   0.015191
5.6.7.6   <->            1.2.3.4        1        1
23:57:20.806478    23:57:20.822145   0.015667      1   0.015667
5.6.7.5   <->            1.2.3.4        1        1

On Mon, Mar 21, 2011 at 1:19 PM, Carter Bullard <carter at qosient.com> wrote:
> Hmmm, it doesn't look like you have any bugs getting in your way,
> so you should be able to do what you want.  So what does this generate?
>
>   racluster -r files -s stime ltime dur trans mean saddr dir daddr spkts dpkts  host 1.2.3.4
>
> Do these numbers look reasonable?
> Carter
>
> On Mar 21, 2011, at 12:56 PM, Digital Ninja wrote:
>
>> Ok, so going back to what Rafael said about the 5-tuple aggregation...
>> When I run ra against the files with the following flags:
>>
>> ra -nn -c "," -r <file> <file> <file> ... -L0 -s stime proto saddr dir
>> daddr dur sport dport - host 1.2.3.4
>>
>> I get the following:
>>
>> 03:57:23.529664,17,5.6.7.5,<->,1.2.3.4,0.014637,30416,53
>> 09:57:27.624699,17,5.6.7.5,<->,1.2.3.4,0.014608,29294,53
>> 12:57:29.660667,17,5.6.7.5,<->,1.2.3.4,0.015812,49771,53
>> 13:57:30.339190,17,5.6.7.5,<->,1.2.3.4,0.015056,6923,53
>> 14:57:31.030846,17,5.6.7.5,<->,1.2.3.4,0.015539,31211,53
>> 16:57:32.385680,17,5.6.7.5,<->,1.2.3.4,0.015089,14851,53
>> 18:57:33.772816,17,5.6.7.5,<->,1.2.3.4,0.015287,1052,53
>> 20:57:18:761336,17,5.6.7.5,<->,1.2.3.4,0.015414,6004,53
>> 20:57:18:793793,17,5.6.7.5,<->,1.2.3.4,0.015191,31141,53
>> 23:57:20.806478,17,5.6.7.5,<->,1.2.3.4,0.015667,30562,53
>>
>> Eyeballing the total time from beginning to end looks to be ~20 hours,
>> with each connection actually lasting < .02 seconds.  The 72k seconds
>> from the racluster works out to about 22 hours, which would make sense
>> if there were overlaps in connection time, but there aren't.  What am
>> I missing here? Is there a way to get the aggregated results I
>> expected (in the original email) from racluster without summing them
>> external to argus?
>>
>> Can it then be assumed then, based on my racluster flags, racluster is
>> aggregating all sessions for the 1.2.3.4 IP based on the 5-tuple of
>> 1.2.3.4:53 -> 0.0.0.0:0?
>>
>> Thanks for all your help!
>>
>> On Mon, Mar 21, 2011 at 11:05 AM, Rafael Barbosa <rrbarbosa at gmail.com> wrote:
>>> racluster(), by default, aggregates all records with the same 5-tuple in a
>>> single one. The resulting record has the start time of the first record and
>>> the end time of the last one.
>>> In your example the duration should be the end time of the last record (the
>>> one with 96 bytes) minus the start time of the first one (with 213 bytes).
>>> However without the files you are using is hard to say for sure.
>>> Best regards,
>>> Rafael Barbosa
>>> http://www.vf.utwente.nl/~barbosarr/
>>>
>>>
>>> On Mon, Mar 21, 2011 at 3:34 PM, Digital Ninja <dn1nj4 at gmail.com> wrote:
>>>>
>>>> I ran across something with racluster v3.0.2 & v3.0.4 that I can't
>>>> quite explain and need some help.  I have 9 different argus files.  I
>>>> am running racluster with the following options:
>>>>
>>>> racluster -M rmon -nn -c "," -m saddr proto sport -r <file> -L0 -s
>>>> saddr proto sport sbytes dur dbytes - not arp
>>>>
>>>> When I run this command on the 9 files separately, for a single IP I
>>>> get something like this:
>>>>
>>>> 1.2.3.4,17,53,289,0.47648,213
>>>> 1.2.3.4,17,53,133,0.015667,117
>>>> 1.2.3.4,17,53,133,0.014637,117
>>>> 1.2.3.4,17,53,133,0.014608,117
>>>> 1.2.3.4,17,53,133,0.015812,117
>>>> 1.2.3.4,17,53,133,0.015056,117
>>>> 1.2.3.4,17,53,133,0.015539,117
>>>> 1.2.3.4,17,53,133,0.015089,117
>>>> 1.2.3.4,17,53,133,0.015287,96
>>>>
>>>> Summing the bytes and duration columns up, I would expect the totals to
>>>> be:
>>>> 1.2.3.4,17,53,1376,0.169343,1128
>>>>
>>>> However, when I run racluster on all 9 files simultaneously (-r <file>
>>>> <file> <file>...etc) I get the following results for the above data:
>>>> 1.2.3.4,17,53,1376,79215.023438,1128
>>>>
>>>> What's going on with the duration field??
>>>>
>>>> Thanks in advance.
>>>
>>>
>>
>
>