How does Argus measure jitter?

[Nik Mitev]

Thanks Carter - for a useful, short and to the point reply. Things look
promising, so I will elaborate on my targets.

I am looking at using Argus for monitoring the QoS the network provides
for voice traffic. This includes network jitter as described in your
reply, packet loss and one-way delay.
Cisco IP SLA is an obvious candidate for the job, but it is currently
buggy and not working on our 2960S switches, plus it monitors switch to
switch connections rather than server to endpoint and generates extra
traffic.
Although Argus has the disadvantage that it does not have an instance at
the source and destination of a probe, it analyses actual production
traffic and not an artificial sample which hopefully offsets any
inaccuracy introduced by the fact that it views flows from outside.


> However, because each argus record has 4 microSecond timestamps, one for the first and last observed packet in either direction, Argus data can be used to generate sampled network jitter.  This is done through differencing matching flow records from two independant probes that are deployed near or in the end systems of interest.  A good one-way delay measurement requires that the two probes be time synchronized, but formulating a decent estimate of the variance of the delay ( network jitter ) doesn't require synchronization, as long as the two sensors clocks are not drifting.
> 
> Argus data can also be used to calculate network transit time (NTT) which is ( RTT - Host Delay ), because argus is a bi-directional flow monitor.  This is also done through differencing matching flow data from two independant probes, deployed in the end systems, in this case time synchronization is not needed.  This generates a very good metric for bi-directional network jitter, as the host component is removed.
> 
> Argus is designed specifcially to enable these types of metrics, as the probe is self-synchronizing.  The two independent sensors, looking at the same packet stream, will generate network flow data that is packet aligned.

Could you put this in an example, hopefully with some formulae for the
calculations? The best way to describe our topology would be two
hub-and-spoke networks linked together at the hubs with our own fibre.
If the stream to be analysed is a call segment from an IP phone at a
spoke location to a server in a data centre at the hub and Argus is fed
data from a SPAN port on the hub switch how would the network jitter
calculation look? All endpoints are synchronised to the same set of ntp
servers on site.

Thanks
Nik