<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hey Ming,<div>Well, I found few bugs because you’re running v3, so no problems at all …</div><div>Argus clients should do the right thing regardless of version …</div><div><br></div><div>I still need to look at how argus works with sequence number roll-over, as that is the condition I believe where we are getting into trouble.</div><div>The data in the records is good, except for the metrics ... because this is a little-endian machine, there is an opportunity to mess up the host to network byte conversions we need to do to export the records … there is supplemental information for each TCP, like window performance, out of order tracking, gaps, loss, and retransmission rates, and all that data looks ok for the flow records that are reporting wild pkts and bytes … so I’m still working it …</div><div><br></div><div><div>Carter<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Nov 13, 2024, at 11:48 AM, Ming Fu <Ming.Fu@esentire.com> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Hi Carter,<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">You are right. The affected machine is still running version 3, not sure how I missed this. Sorry for the confusion of the versions. I will upgrade and test.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Thanks,<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Ming<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span>Carter Bullard <carter@qosient.com><br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, November 13, 2024 11:09 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Ming Fu <Ming.Fu@esentire.com><br><b>Cc:</b><span class="Apple-converted-space"> </span>Argus <argus-info@lists.andrew.cmu.edu><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [ARGUS] the packet and byte count are unreasonably high<o:p></o:p></span></div></div></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Hey Ming,<o:p></o:p></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">With regards to our bug … is the argus that is generating the issue an argus-3.0 sensor ??<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Carter<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">On Nov 11, 2024, at 3:29<span style="font-family: Arial, sans-serif;"> </span>PM, Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>> wrote:<o:p></o:p></div></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Hi Carter,</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"> </span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">We use the plain default configure command to run the auto configure.</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"> </span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Regards,</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Ming</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"> </span><o:p></o:p></div></div><div><div style="border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-color: currentcolor; border-image: none;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Carter Bullard <<a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;">carter@qosient.com</a>><br><b>Sent:</b><span class="apple-converted-space"> </span>Monday, November 11, 2024 1:12 PM<br><b>To:</b><span class="apple-converted-space"> </span>Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>><br><b>Cc:</b><span class="apple-converted-space"> </span>Argus <<a href="mailto:argus-info@lists.andrew.cmu.edu" style="color: blue; text-decoration: underline;">argus-info@lists.andrew.cmu.edu</a>><br><b>Subject:</b><span class="apple-converted-space"> </span>Re: [ARGUS] the packet and byte count are unreasonably high</span><o:p></o:p></div></div></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">@ 3.5Gbps we'll tickle the 64-bit counters in argus with a 30s flow duration ... should not be a problem but .... very interesting regarding LBL_ALIGN not being defined ... maybe a real hint ...<o:p></o:p></div></div><div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Carter<o:p></o:p></div></div><div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="360" id="sig" style="width: 3.75in; border-collapse: collapse;"><tbody><tr><td width="142" style="width: 106.5pt; padding: 0in;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><a href="http://qosient.com/" title="QoSient" style="color: blue; text-decoration: underline;"><span style="font-size: 13pt; font-family: "Times New Roman", serif; color: rgb(149, 79, 114); border: 1pt windowtext; padding: 0in; text-decoration: none;"><image001.png></span></a><o:p></o:p></div></div></td><td width="16" style="width: 12pt; padding: 0in; min-width: 16px;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 13pt; font-family: "Times New Roman", serif;"> </span><o:p></o:p></div></div></td><td style="padding: 0in;"><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" id="sig2"><tbody><tr><td nowrap="" style="padding: 0in;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-family: Arial, sans-serif;"><a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;"><span style="color: rgb(0, 0, 176); border: 1pt windowtext; padding: 0in; text-decoration: none;">Carter Bullard</span><span style="color: rgb(149, 79, 114); border: 1pt windowtext; padding: 0in; text-decoration: none;"> </span></a></span><span style="font-size: 9pt; font-family: Arial, sans-serif;">•</span><span style="font-family: Arial, sans-serif;"> </span><span style="font-size: 9pt; font-family: Arial, sans-serif;">CEO</span><o:p></o:p></div></div></td></tr><tr><td nowrap="" style="padding: 0in;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 9pt; font-family: Arial, sans-serif;">250 E 53rd Street Suite 501</span><o:p></o:p></div></div></td></tr><tr><td nowrap="" style="padding: 0in;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 9pt; font-family: Arial, sans-serif;">New York, New York 10022</span><o:p></o:p></div></div></td></tr><tr><td nowrap="" style="padding: 0in;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 9pt; font-family: Arial, sans-serif;">Phone +1.212.588.9133 • Mobile +1.917.497.9494</span><o:p></o:p></div></div></td></tr></tbody></table></td></tr></tbody></table></div><div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><br><br><br><o:p></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: Aptos, sans-serif;">On Nov 11, 2024, at 1:08<span style="font-family: Arial, sans-serif;"> </span>PM, Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>> wrote:<o:p></o:p></p></blockquote></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-family: Tahoma, sans-serif;"></span>Hi Carter,<br><br>It happens on machine with 10G and machine with multiple 1G interfaces, however, the total throughput is no more than 3.5G at peak.<br><br>Regards,<br>Ming<br>-----Original Message-----<br>From: Carter Bullard <<a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;">carter@qosient.com</a>><br>Sent: Monday, November 11, 2024 11:36 AM<br>To: Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>><br>Cc: Argus <<a href="mailto:argus-info@lists.andrew.cmu.edu" style="color: blue; text-decoration: underline;">argus-info@lists.andrew.cmu.edu</a>><br>Subject: Re: [ARGUS] the packet and byte count are unreasonably high<br><br>And one last question … what is the max bandwidth of the links you're monitoring ? (10 Gbps ??)<br>Carter<br><br><br><br><br><o:p></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">On Nov 11, 2024, at 11:26<span style="font-family: Arial, sans-serif;"> </span>AM, Carter Bullard <<a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;">carter@qosient.com</a>> wrote:<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Hey Ming,<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Important question … what is the status of the LBL_ALIGN variable in your ./include/argus_config.h file ???<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">On my systems it is defined …<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> % grep LBL_ALIGN ./include/argus_config.h<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> include/argus_config.h:#define LBL_ALIGN /**/<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Carter<o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">On Nov 11, 2024, at 10:42<span style="font-family: Arial, sans-serif;"> </span>AM, Carter Bullard <<a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;">carter@qosient.com</a>> wrote:<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Hey Ming,<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Based on your earlier email … this should work to generate an argus file with about 24 records in it that would include errant flows as a well as reasonable flows for the same flow ??<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">% ra -w /tmp/argus.big.counter.flow.out -r argus.vsniff1.2024-10-11-22* - src host 10.61.6.12 and port 62275<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">If you can grab even tighter times, if you can get the specific flow between 2024-10-11.22:15:06 - 2024-10-11.22:21:15<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">That should catch normal -> errant -> normal for a single flow …<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">All ra* programs can write its output to an argus data file, so by using the filter, you can grab the flows you want and create a manageable file ...<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Carter<o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">On Nov 11, 2024, at 10:23<span style="font-family: Arial, sans-serif;"> </span>AM, Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>> wrote:<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Hi Carter,<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">The problem does not happen often, so unless we search for it on purpose across a large set of archives, we may not see it. We notice the problem mostly because we hit it during a query. I can't reproduce the problem in testing environment.<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Is there a command to extract just the affected connection from the original archive file into a smaller archive? There are barriers other than just the size to share the full archive.<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Regards<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Ming<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">-----Original Message-----<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">From: Carter Bullard <<a href="mailto:carter@qosient.com" style="color: blue; text-decoration: underline;">carter@qosient.com</a>><o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Sent: Monday, November 11, 2024 10:12 AM<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">To: Ming Fu <<a href="mailto:Ming.Fu@esentire.com" style="color: blue; text-decoration: underline;">Ming.Fu@esentire.com</a>><o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Cc: Argus <<a href="mailto:argus-info@lists.andrew.cmu.edu" style="color: blue; text-decoration: underline;">argus-info@lists.andrew.cmu.edu</a>><o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Subject: Re: [ARGUS] the packet and byte count are unreasonably high<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Hey Ming,<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">We were working on this issue last year about this same time …. And in June/July (?) you thought we had fixed the problem …<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">No problem, just wanting to know if it went away and then came back ?? Or maybe we were just lucky ??<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Can you share a recent binary file of a record that is tooooo big ??<o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"> <o:p></o:p></div></div></blockquote></blockquote></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;">Carter</div></div></blockquote></blockquote></blockquote></div></blockquote></div></div></blockquote></div></div></div></div></div></blockquote></div><br></div></div></body></html>