Another vote for packet drop detection

[MN]

>From Carter's posts:
> This type of algorithm can't perform at line rate (1Gbps +) while
> tracking 1M+ concurrent connections, which is a performance target
> for argus, so I'll try to derive a metric from our existing loss
> algorithm.   We should be able to report a reliable "unobserved
> bytes" metric.

> [later message on algorithms / speed]

One possibility is to do a full analysis on a small fraction (10^-4,
10^-6...) of flows.  A simple report in the man/mar records would 
be either a great relief or a call to action.

I've not seen a mention of selective acks (SACK) and how they might
be accounted for.  But, on at least two sites at which I've consulted,
turning off SACKs made the site run *much* better, so maybe those
sessions should just be ignored.

Many thanks for a great tool.
- mike