question re ARGUS_GENERATE_APPBYTE_METRIC

[Carter Bullard]

Hey Jim,
The appbytes metrics allow you to measure effective load, while the
bytes metrics are all about total load, which includes all the various
headers needed to be on the wire.  Normally you use " effective / total "
to provide you with an indication of efficiency, or goodput vs throughput.
" Took how many bytes to transmit a 1MB file ? "   With retransmissions,
small MTU and lots of encapsulation overhead,  the efficiency can go
down, pretty quick.

" Bytes per time period " is not a common metric to track compared to
" Load " which is in bits / sec.  Reason is, the former demands that you
divide your metrics into fixed time periods, and the later is something of
a normalization of demand over time ( just divide load by duration ).  Nice
thing is, the argus clients tools allow you a lot of flexibility.

To do " bytes per time period ", you will want to use rabins() to get the
metrics into the time period you are interested in (-M time xxx option) ,
you will want to aggregate the data into the network objects you're interested
in (something like '-m saddr daddr proto dport' ), and be sure and respect
the bi-directional indicators to retain the client / server semantics, say using
filters.

If you have any problems getting the numbers you want, just send email.

Carter

On Mar 13, 2013, at 2:48 PM, "James A. Robinson" <jimr at highwire.stanford.edu> wrote:

> Hi Folks,
> 
> If I want to be able to measure how many bytes per time period a
> particular client or set of clients are requesting from a server, will
> I need to enable ARGUS_GENERATE_APPBYTE_METRIC?
> 
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> James A. Robinson                       jimr at highwire.stanford.edu
> HighWire | Stanford University          http://highwire.stanford.edu/
> +1 650 7237294 (Work)                   +1 650 7259335 (Fax)
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2589 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130313/192936cd/attachment.bin>