Inter packet arrival times, etc
Carter Bullard via Argus-info
argus-info at lists.andrew.cmu.edu
Tue Mar 1 19:08:59 EST 2016
Hey John,
Hmmmm, well its long shot, but maybe you have another argus running on port 1776 ???
Try this type of call just to make sure …
thoth:argus carter$ argus -XJZ -w - | ra -s stime dur sintpkt dintpkt spkts dpkts
ArgusAlert: 01 Mar 16 19:07:49.309170 started
ArgusAlert: 01 Mar 16 19:07:49.314159 ArgusGetInterfaceStatus: interface en0 is up
StartTime Dur SIntPkt DIntPkt SrcPkts DstPkts
2016/03/01.19:07:49.450105 4.903775 114.038508 108.971445 44 46
2016/03/01.19:07:50.169456 4.755407 951.058188 951.062812 6 6
2016/03/01.19:07:51.740083 0.000000 1 0
2016/03/01.19:07:54.527459 4.951990 119.199281 119.199672 43 43
2016/03/01.19:07:56.070868 4.577656 953.943500 953.951312 6 6
2016/03/01.19:07:57.956988 0.000000 1 0
Carter
> On Mar 1, 2016, at 7:00 PM, John T. Myers <myersj0 at gmail.com> wrote:
>
> Carter,
>
> I am running the most recent versions of both argus and ra.
>
> I am not using an /etc/argus.conf file.
>
> Here's what I'm running:
> sudo /usr/local/sbin/argus -XJZ -P 1776
>
> Here's my output:
>
> $ ra -S 127.0.0.1:1776 -s stime dur sintpkt dintpkt spkts dpkts
>
> StartTime Dur SIntPkt DIntPkt SrcPkts DstPkts
>
> 18:57:03.409875 4.706442 7 7
>
> 18:57:04.511125 0.011859 2 1
>
> 18:57:04.511759 2.522828 17 13
>
> 18:57:05.086039 0.013790 1 1
>
> 18:57:07.152224 0.079377 4 4
>
> 18:57:07.158213 0.003873 1 1
>
> 18:57:07.162894 0.355735 9 7
>
> 18:57:07.181655 2.867576 2 0
>
> 18:57:07.218432 0.076724 2 1
>
> 18:57:07.386298 3.072719 2 0
>
> 18:57:07.648119 0.849830 4 4
>
> 18:57:08.050722 1.124733 3 3
>
> 18:57:08.443340 4.793475 7 7
>
> 18:57:08.815269 0.000000 1 0
>
> 18:57:08.815880 0.000000 1 0
>
> 18:57:09.361360 0.000000 1 1
>
> 18:57:12.299458 0.082107 2 1
>
> 18:57:13.121569 0.409717 4 0
>
> 18:57:13.121967 0.410232 4 0
>
> 18:57:13.326743 2.867111 2 0
>
> 18:57:13.532298 3.071525 2 0
>
> 18:57:13.566275 4.931359 7 7
>
> 18:57:16.108317 0.000000 1 0
>
> 18:57:16.367749 0.000000 1 0
>
> 18:57:16.367961 0.000000 1 0
>
> 18:57:17.384924 0.076498 2 1
>
> 18:57:18.493563 0.006411 2 1
>
> 18:57:18.822255 4.951610 7 7
>
> 18:57:19.170851 0.007446 2 1
>
> 18:57:19.471014 0.000000 1 0
>
> 18:57:19.675868 3.072499 2 0
>
> 18:57:20.343892 0.010916 1 1
>
> 18:57:21.929061 0.000000 1 0
>
> 18:57:22.134655 1.023289 2 0
>
> 18:57:22.462428 0.076372 2 1
>
> 18:57:22.954646 4.716694 2 3
>
> 18:57:24.100218 4.836413 30 29
>
>
> 18:57:25.820692 3.072441 2 0
>
>
> On Tue, Mar 1, 2016 at 6:37 PM, Carter Bullard <carter at qosient.com> wrote:
> Hey John,
> Well, its working for me, so we have to figure out what your particular issue is …
> First thing is to grab the latest code to see if that fixes your issue …
>
> http://qosient.com/argus/dev/argus-latest.tar.gz (which is argus-3.0.8.1)
> http://qosient.com/argus/dev/argus-clients-latest.tar.gz (which is argus-3.0.8.2.rc.2)
>
> Next is to see the actual argus and ra command line options you are using, that way we can see that you should be generating the right data, and that you’re printing the right fields. If you have an /etc/argus.conf file, you may want to use the “-X” as the first option to argus, to eliminate any interference from your system configuration.
>
> This is the kind of output I would expect from printing out data.
>
> thoth:argus carter$ ra -S localhost -s stime dur sintpkt dintpkt
> StartTime Dur SIntPkt DIntPkt
> 2016/03/01.18:35:47.120828 105232.68*
> 2016/03/01.18:35:45.370833 0.004182
> 2016/03/01.18:35:45.371048 0.006204
> 2016/03/01.18:35:45.389638 0.003608
> 2016/03/01.18:35:45.389874 0.006610
> 2016/03/01.18:35:45.783550 0.102185 102.185000
> 2016/03/01.18:35:45.981787 0.000345 0.345000
> 2016/03/01.18:35:46.341460 1.792576 100.419898 100.418047
> 2016/03/01.18:35:46.596191 0.000000
> 2016/03/01.18:35:46.716520 0.000000
> 2016/03/01.18:35:46.903525 0.000000
> 2016/03/01.18:35:46.946131 1.502750 470.739594 470.732813
> 2016/03/01.18:35:48.365561 1.987141 92.444414 79.240289
> 2016/03/01.18:35:48.449544 0.195982 16.331833 21.804000
> 2016/03/01.18:35:48.517958 0.000000
> 2016/03/01.18:35:48.746586 0.000000
>
>
> Then if all is odd, then if you can send some of your argus data, I can test to see what could be the problem.
> Carter
>
>
> > On Mar 1, 2016, at 5:43 PM, John T. Myers <myersj0 at gmail.com> wrote:
> >
> > I'm using 3.0.8.1.
> >
> > I've enabled both -JZ and both fields are still blank.
> >
> > I enabled spkts and dpkts, and many records have > 1 packet, still getting blank for all the other fields.
> >
> > On Tue, Mar 1, 2016 at 5:36 PM, Carter Bullard <carter at qosient.com> wrote:
> > Hey John,
> > What version of argus are you using ???
> > You will get blanks for the SIntPkt and DIntPkt fields if there aren’t more than 1 packet in the flow record.
> > Try printing out at least the spkts and dpkts fields to see that you are getting multiple packets.
> >
> > You are not turning on source packet size reporting, which needs the -Z option, so do you mean +dintpkt instead of +spktsz ?????
> >
> > Carter
> >
> >> On Mar 1, 2016, at 5:29 PM, John T. Myers via Argus-info <argus-info at lists.andrew.cmu.edu> wrote:
> >>
> >> Hi,
> >>
> >> I'm trying to enable SIntPkt and other similar metrics on live collection against an interface.
> >>
> >> Which Argus options enable this? I've tried -J but it does not work.
> >>
> >> The two commands I'm using are:
> >>
> >> sudo /usr/local/sbin/argus -i en0 -P 1776 -J
> >>
> >> and then trying...
> >>
> >> ra -A -S 127.0.0.1:1776 -s +sintpkt +spktsz
> >>
> >> The additional fields I'm trying to capture are blank, though.
> >>
> >> Thanks!
> >> John
> >
> >
>
>
More information about the argus
mailing list