Argus 3.0.7.2 vs. 3.0.6.1

[Carter Bullard]

Hey Jesper Skou Jensen,
So are you reading multiple interfaces at the same time?

We've got reports of very poor performance when we're binding or
dup'ing multiple interfaces, in some architectures.

If that's not it, there are a lot of new features in argus-3.0.7.x,
some of these maybe eating a lot of cycles.  If that's not it,
how are you running your comparisons?  Two argi on the same machine,
and interface?  Are you using PF_RING ???

This is important, as performance seems to have degraded for
multiple sites, so hopefully we can figure this out…..

Carter


On Jun 11, 2013, at 4:59 AM, Jesper Skou Jensen <jesper.skou.jensen at uni-c.dk> wrote:

> Hi guys,
> 
> I'm in the process of setting up a new Argus box and decided to try out the newest development version of Argus instead of the somewhat old stable version. BUT... It turns out that the new Argus isn't capturing remotely as much data as the old one, and I'm trying to figure out why this is happening, if it's an error at my end, or it's a bug. I hope you guys can help out.
> 
> I have captured two identical streams on one Argus running 3.06.1 and another running 3.0.7.2. Then I have selected the same 1 minute segment (with the -t option) and are now comparing those.
> 
> # racount -r argus_3.0.6.1.ra
> racount   records     total_pkts     src_pkts       dst_pkts total_bytes        src_bytes          dst_bytes
>    sum   250712      3763810        2148834        1614976 2568139699         641553337          1926586362
> 
> # racount -r argus_3.0.7.2.ra
> racount   records     total_pkts     src_pkts       dst_pkts total_bytes        src_bytes          dst_bytes
>    sum   109070      502597         322519         180078 385799043          190698708          195100335
> 
> If I use ragraph to draw some graphs it's very clear that the 3.7.0.2 captures around 1/6th of the traffic.
> 
> Any ideas why?
> 
> 
> --
> Regards
> Jesper Skou Jensen
> UNI-C
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130611/008e2216/attachment.bin>