Is `seq` always unique?

[Carter Bullard]

Rollover refers to when the number exceeds the largest 32-bit maximum unsigned integer.  We rollover to 1, not 0, as 0 is a special record.

So the seq + srcid will be unique within a time window, so combining it with the stime would be unique.

Carter

On Jul 25, 2013, at 10:39 AM, Matt Brown <matthewbrown at gmail.com> wrote:

> Thanks Carter.
> 
> Cool.  So, it tracks ordering of two sets (says wikipedia) by using an always increasing 32-bit unsigned integer.
> 
> What do you mean by "with automatic roll-over detection"?  Does this mean that it will always progress from where it left off regardless of if I start a new `argus` or not?
> 
> MAR records are discussed here: http://thread.gmane.org/gmane.network.argus/9124
> 
> 
> I am writing a python script that parses the output of `radump ... - port domain` and inserts DNS records into a DB.  I am storing records using a reference strategy (this is probably less efficient than just storing the values straight away), where each ns client, ns server, answer and question names/hosts and types have an associated unique ID (an auto-incrementing field).  I will have multiple db records associated with the same "flow" (for example, one flow q&a might have 11 answer hosts and types).  I am trying to use something derived or use something existent that uniquely identifies a flow.  Will `seq` do this alone?
> 
> If you don't mind me asking: considering multi-threaded sql activities, what is the strategy used with rasqlinsert()?  I'm considering utilizing the "queuing" provided by the expectedly blocked python client access to the db (but I expect that my client connections will run quite high).
> Does rasqlinsert() use an independant query cache, tracking that each query return confirmed?
> 
> 
> Thanks,
> 
> Matt
> 
> On Jul 25, 2013, at 12:24 PM, Carter Bullard <carter at qosient.com> wrote:
> 
>> Oooops, thought I had responded, sorry for the delay.
>> The ' seq ' is a transport sequence number and is independent of the
>> flow itself.  Its used for flow record loss and reordering detection for non-TCP
>> argus record transport, such as argus-udp, but you can use it for other things.
>> It is "a monotonically increasing 32-bit unsigned integer, with automatic
>> roll-over detection.  The zero record is reserved to be a MAR record."
>> 
>> So, if you have 2 status records from the same flow, you should have
>> different transport sequence numbers.
>> 
>> Carter 
>> 
>> On Jul 24, 2013, at 11:22 AM, Matt Brown <matthewbrown at gmail.com> wrote:
>> 
>>> Hello,
>>> 
>>> Is `seq` always unique?  Meaning, even through cycles of the argus
>>> process?  Meaning, like totally always unique?
>>> 
>>> Curious if I need to consider something else, like hashing `ltime` and
>>> `seq` to create something always unique.
>>> 
>>> 
>>> Thanks,
>>> 
>>> Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130726/3f04a9b9/attachment.html>