Inter packet arrival times, etc
Carter Bullard via Argus-info
argus-info at lists.andrew.cmu.edu
Tue Mar 1 18:37:31 EST 2016
Well, its working for me, so we have to figure out what your particular issue is …
First thing is to grab the latest code to see if that fixes your issue …
http://qosient.com/argus/dev/argus-latest.tar.gz (which is argus-188.8.131.52)
http://qosient.com/argus/dev/argus-clients-latest.tar.gz (which is argus-184.108.40.206.rc.2)
Next is to see the actual argus and ra command line options you are using, that way we can see that you should be generating the right data, and that you’re printing the right fields. If you have an /etc/argus.conf file, you may want to use the “-X” as the first option to argus, to eliminate any interference from your system configuration.
This is the kind of output I would expect from printing out data.
thoth:argus carter$ ra -S localhost -s stime dur sintpkt dintpkt
StartTime Dur SIntPkt DIntPkt
2016/03/01.18:35:45.783550 0.102185 102.185000
2016/03/01.18:35:45.981787 0.000345 0.345000
2016/03/01.18:35:46.341460 1.792576 100.419898 100.418047
2016/03/01.18:35:46.946131 1.502750 470.739594 470.732813
2016/03/01.18:35:48.365561 1.987141 92.444414 79.240289
2016/03/01.18:35:48.449544 0.195982 16.331833 21.804000
Then if all is odd, then if you can send some of your argus data, I can test to see what could be the problem.
> On Mar 1, 2016, at 5:43 PM, John T. Myers <myersj0 at gmail.com> wrote:
> I'm using 220.127.116.11.
> I've enabled both -JZ and both fields are still blank.
> I enabled spkts and dpkts, and many records have > 1 packet, still getting blank for all the other fields.
> On Tue, Mar 1, 2016 at 5:36 PM, Carter Bullard <carter at qosient.com> wrote:
> Hey John,
> What version of argus are you using ???
> You will get blanks for the SIntPkt and DIntPkt fields if there aren’t more than 1 packet in the flow record.
> Try printing out at least the spkts and dpkts fields to see that you are getting multiple packets.
> You are not turning on source packet size reporting, which needs the -Z option, so do you mean +dintpkt instead of +spktsz ?????
>> On Mar 1, 2016, at 5:29 PM, John T. Myers via Argus-info <argus-info at lists.andrew.cmu.edu> wrote:
>> I'm trying to enable SIntPkt and other similar metrics on live collection against an interface.
>> Which Argus options enable this? I've tried -J but it does not work.
>> The two commands I'm using are:
>> sudo /usr/local/sbin/argus -i en0 -P 1776 -J
>> and then trying...
>> ra -A -S 127.0.0.1:1776 -s +sintpkt +spktsz
>> The additional fields I'm trying to capture are blank, though.
More information about the argus