argus quits with error "drop request firstseqnum is 0"

[Carter Bullard]

Hey Kaustubh,
OK, so if we get malformed UDT drop requests, which is a protocol violation,
we currently use

   ArgusLog(LOG_ERR, ...)

to report the protocol error.  That is a bit extreme, and unnecessary.
The correct fix, which is to report the protocol violation in the flow
records, changes 4 files.  Rather than provide a set of patch files,
here is a complete argus distribution (argus-3.0.8.2.rc) that has the fix.
If you could test this, that would be great !!!!

If you could send me some kind of thumbs up or down, if up I’ll start
to distribute this fix for real testing.

Carter



> On Jun 26, 2015, at 11:35 AM, Carter Bullard <carter at qosient.com> wrote:
> 
> Hey Kaustubh,
> If you think it is a packet specific problem, if you can capture a packet stream that argus complains about, I can debug very quickly.  Is this possible ??
> 
> Carter
> 
>> On Jun 26, 2015, at 10:50 AM, Kaustubh Gadkari <kaustubh.gadkari at gmail.com <mailto:kaustubh.gadkari at gmail.com>> wrote:
>> 
>> Carter,
>> 
>> I am running into an issue where argus quits after throwing a "drop request firstseqnum is 0" error. My understanding is that this has something to do with UDT traffic. I found an older message (http://permalink.gmane.org/gmane.network.argus/10839 <http://permalink.gmane.org/gmane.network.argus/10839>) where you gave a patch for this error. I applied this patch, but argus still quits when it runs across this particular kind of traffic.
>> 
>> I am using argus-3.0.8.1.
>> 
>> Thanks,
>> Kaustubh
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20150629/9ce3bdf2/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: argus-3.0.8.2.rc.tar.gz
Type: application/x-gzip
Size: 523759 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20150629/9ce3bdf2/attachment.bin>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20150629/9ce3bdf2/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20150629/9ce3bdf2/attachment-0001.bin>