[ARGUS] Ipv6 fragmentation tracking issue

Carter Bullard carter at qosient.com
Wed Nov 6 12:29:54 EST 2019


Gentle people,
We discovered a bug in the IPv6 fragmentation tracking code where fragments we’re not being hashed to its parent IPv6 flow, causing argus to generate “    f    “ status indications on some IPv6 flows (lower case ‘f’ is a flow record that represents fragments that couldn’t be mapped to its original flow).  The flow data is correct, in that we’re accounting for the fragmented traffic, but we aren’t doing the right thing.

We have a fix, and are testing it now.  If you are monitoring IPv6 and see some of these flows, send me a note, and I’ll try to get the fix to you, if you would like to test it.
Hope all is most excellent,

Carter


More information about the argus mailing list