headers
Andrew Pollock | 5 Jun 2003 03:40
Picon
Favicon

Me and my usual questions

Hi,

I'm the never ending purgatory that is my life, I'm trying to make Argus 
produce consistently sensible data, and as usual, failing miserably.

I'm going to go back to square one:

We have a network topology like this:

              LB        LB
               |         |
            +--------------+
            |              |
Argus ------| Switch       |
            |              |
            +--------------+
             | | | | | | | 
             |     |   |
           Client  | Client  
               Client

We have a switch, to which two load balancers are attached (one being 
active at any point in time) and we have our clients connected to the 
switch as well. Argus is running on a server plugged into a port on the 
switch that spans the two ports that the load balancers are plugged into.

Each client has a /24 of their own, with the exception of a couple of 
clients that have a single /32

Today's focus is one of the clients that have just a /32
(Continue reading)

Permalink | Reply | 0 comments |
headers
Carter Bullard | 5 Jun 2003 17:21

RE: Me and my usual questions

Hey Andrew,
   So how do they differ?  are the totals the same
but the src and dst counters mixed, or is one low?
They should all count the same total pkts and bytes.

Carter

> -----Original Message-----
> From: owner-argus-info <at> lists.andrew.cmu.edu 
> [mailto:owner-argus-info <at> lists.andrew.cmu.edu] On Behalf Of 
> Andrew Pollock
> Sent: Wednesday, June 04, 2003 9:40 PM
> To: argus-info <at> lists.andrew.cmu.edu
> Subject: Me and my usual questions
> 
> 
> Hi,
> 
> I'm the never ending purgatory that is my life, I'm trying to 
> make Argus 
> produce consistently sensible data, and as usual, failing miserably.
> 
> I'm going to go back to square one:
> 
> We have a network topology like this:
> 
>               LB        LB
>                |         |
>             +--------------+
>             |              |
(Continue reading)

Permalink | Reply | 0 comments |
headers
Carter Bullard | 5 Jun 2003 17:23

RE: Me and my usual questions

Andrew,
   Svc only counts udp and tcp traffic, as you have
to have a port to do the svc counting.  Try your ramon
calls with the "tcp or udp" filter to verify.

Carter

> -----Original Message-----
> From: owner-argus-info <at> lists.andrew.cmu.edu 
> [mailto:owner-argus-info <at> lists.andrew.cmu.edu] On Behalf Of 
> Andrew Pollock
> Sent: Wednesday, June 04, 2003 9:40 PM
> To: argus-info <at> lists.andrew.cmu.edu
> Subject: Me and my usual questions
> 
> 
> Hi,
> 
> I'm the never ending purgatory that is my life, I'm trying to 
> make Argus 
> produce consistently sensible data, and as usual, failing miserably.
> 
> I'm going to go back to square one:
> 
> We have a network topology like this:
> 
>               LB        LB
>                |         |
>             +--------------+
>             |              |
(Continue reading)

Permalink | Reply | 2 comments |

Gmane