Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Carter Bullard | 1 Oct 2001 17:21

argus-2.0.2.redux

Gentle people,
   Sorry for the delay in getting argus-2.0.2.redux out for
testing.  This version should fix the OpenBSD compiling
problems that Peter solved, and has some minor fixes in
argus for memory leaks.

ftp://qosient.com/dev/argus-2.0/argus-2.0.2.redux.tar.gz

   Please give this a test, as I would like to officially
release it at the end of the week.

   argus-2.0.2.redux is being released under GNU's General
Public License, and all future releases of Argus and its
clients will be released under the GPL.  This is a
substantial change in the prior licensing strategy for
Argus.  All users should be aware that the GPL is a more
restrictive license than the QoSient Public License,
so do take time to review how this change may effect
your use of Argus technology.

   If anyone has any comments on this license change,
do send mail to the mailing list!!!

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

(Continue reading)

Shilpa Bansod | 1 Oct 2001 19:42

Picon

Packet loss computation in non-ESP flows

Hi all,
I have been trying to figure out how Argus computes packet loss rate in
non-ESP flows but have not been able to do so as yet. I would greatly
appreciate any insight into this. 

Thanks!
-Shilpa

Carter Bullard | 1 Oct 2001 20:34

RE: Packet loss computation in non-ESP flows

Hey Shilpa,
   Well, there are three basic mechanisms that argus
uses to report on packet loss/retransmission.  The
first is that argus has a complete TCP state machine
and is using that to determine drops and retransmitted
packets.  The second is to track monotonically
increasing sequence numbers when they exist.  Argus
does this with ESP and RTP flows.  And the third
scheme is to enforce symmetric reporting for strict
request/response protocols, so Argus, when run using
the -R option (response mode), Argus generates data
that allows for easy calculation of packets lost.
This mode allows for you to calculate drops for ICMP
echo, traceroute, dns, ntp, portmapper, netbios, etc ...

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: owner-argus-info <at> lists.andrew.cmu.edu 
> [mailto:owner-argus-info <at> lists.andrew.cmu.edu] On Behalf Of

(Continue reading)

Shilpa Bansod | 3 Oct 2001 01:41

Picon

RE: Packet loss computation in non-ESP flows

Hi all,
I cannot seem to find the code that actually computes packet loss. Any
pointers would be appreciated. I understand that the code might be spread
across files, hence any keywords would do too!

Thanks,
-Shilpa

On Mon, 1 Oct 2001, Carter Bullard wrote:

> Hey Shilpa,
>    Well, there are three basic mechanisms that argus
> uses to report on packet loss/retransmission.  The
> first is that argus has a complete TCP state machine
> and is using that to determine drops and retransmitted
> packets.  The second is to track monotonically
> increasing sequence numbers when they exist.  Argus
> does this with ESP and RTP flows.  And the third
> scheme is to enforce symmetric reporting for strict
> request/response protocols, so Argus, when run using
> the -R option (response mode), Argus generates data
> that allows for easy calculation of packets lost.
> This mode allows for you to calculate drops for ICMP
> echo, traceroute, dns, ntp, portmapper, netbios, etc ...
> 
> Carter
> 
> Carter Bullard
> QoSient, LLC
> 300 E. 56th Street, Suite 18K

(Continue reading)

Carter Bullard | 3 Oct 2001 14:45

RE: Packet loss computation in non-ESP flows

Ooops,
   If your looking for the implementation,
its in Argus_tcp.c, Argus_esp.c and Argus_app.c.
Look for keywords like retrans, lost, and drop.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: Shilpa Bansod [mailto:shilpa <at> mtu.edu] 
> Sent: Tuesday, October 02, 2001 7:41 PM
> To: Carter Bullard
> Cc: argus-info <at> lists.andrew.cmu.edu
> Subject: RE: Packet loss computation in non-ESP flows
> 
> 
> Hi all,
> I cannot seem to find the code that actually computes packet 
> loss. Any pointers would be appreciated. I understand that 
> the code might be spread across files, hence any keywords 
> would do too!

(Continue reading)

Peter Van Epp | 5 Oct 2001 18:46

Picon

Picon

Re: argus-2.0.2.redux

> 
> Gentle people,
>    Sorry for the delay in getting argus-2.0.2.redux out for
> testing.  This version should fix the OpenBSD compiling
> problems that Peter solved, and has some minor fixes in
> argus for memory leaks.
> 
> ftp://qosient.com/dev/argus-2.0/argus-2.0.2.redux.tar.gz
> 
>    Please give this a test, as I would like to officially
> release it at the end of the week.
> 

	Late as usual, a couple of bugs (with these two applied OpenBSD 2.8
compiles and runs and the man line prints correctly, I'll verify NetBSD and
FreeBSD in a while).

*** common/argus_util.c.orig	Fri Oct  5 01:36:50 2001
--- common/argus_util.c	Fri Oct  5 01:37:46 2001
***************
*** 1033,1039 ****

     } else {
        if (Iflag)
! #if defined(HAVE_SOLARIS) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD)
           strcpy (fmtstr, "%s%s%4s  pkts %9lld  bytes %12lld  drops %5d  ");
        else
           strcpy (fmtstr, "%s  %4s  pkts %9lld  bytes %12lld  drops %5d  ");
--- 1033,1039 ----

(Continue reading)

Peter Van Epp | 5 Oct 2001 20:15

Picon

Picon

argus-2.0.2.redux

	argus-2.0.2.redux (with the 2 difs applied) successfully compiles and
at a quick glance at the output appears to work with correct man counts on 
all of OpenBSD 2.8, NetBSD 1.5 and FreeBSD 4.4-RELEASE.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

Carter Bullard | 12 Oct 2001 00:00

argus-2.0.3 available for testing

Gentle people,
   Sorry for the delay in getting this out.  I've made the
changes that Peter suggested for OpenBSD porting, and
added a long waiting patch that was supplied by Kevin Miller
at CMU to allow you to control what interface Argus will
bind to for its remote access ports (sorry Kevin for the
delay).  Mods to the man pages and the support/Config/argus.conf
file are included so it should be pretty straight forward
to test.  I've uploaded argus-2.0.3 to the dev directory.

ftp://qosient.com/dev/argus-2.0/argus-2.0.3.tar.gz

If the group could please, put the final kabash to this and if
it passes, I'll announce it's availability, ASAP.

Kevin's change allows you to force the listen to a particular
interface, which can really help in the security of accessing
remote argus data.  Binding to 127.0.0.1 is pretty powerful,
and binding to a specific interface on a dual homed machine
that doesn't do routing can also be pretty powerful.  So 
thanks Kevin!!

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com

(Continue reading)

Peter Van Epp | 12 Oct 2001 04:55

Picon

Picon

Re: argus-2.0.3 available for testing

	Looks good so far. Compiles and runs successfully on OpenBSD 2.8 and
FreeBSD 4.3-RELEASE. I'll check NetBSD in the morning when I can reboot the
OpenBSD machine in to NetBSD.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

Andreas Östling | 12 Oct 2001 10:02

Picon

Picon

Re: argus-2.0.3 available for testing

On Friday 12 October 2001 04.55,  Peter Van Epp wrote:
> Looks good so far. Compiles and runs successfully on OpenBSD 2.8 and
> FreeBSD 4.3-RELEASE. I'll check NetBSD in the morning when I can
> reboot the OpenBSD machine in to NetBSD.

Compiles out of the box and seems to run successfully on OpenBSD 2.9 as 
well, although I've not tested it very much yet.

/Andreas

Group

gmane.network.argus.

Advertisement

Project Web Page

Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6

Articles in period: 58

October 2001

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Netflow - Direction field in argus? (13 Jun 2013)
Time window issue (13 Jun 2013)
Netflow - Direction field in argus? (13 Jun 2013)
Time window issue (12 Jun 2013)
Argus 3.0.7.2 vs. 3.0.6.1 (11 Jun 2013)
Shutdown for rasqlinsert (11 Jun 2013)
Rewrite of rastream (10 Jun 2013)
The direction field (10 Jun 2013)
Rewrite of rastream (10 Jun 2013)
ra* segfault with zero width column size (10 Jun 2013)
ABRatio question (6 Jun 2013)
Spurious web server traffic (3 Jun 2013)
racluster.conf problems (3 Jun 2013)
rasql, rasqlinsert, rasqltimeindex (29 May 2013)
Argus 3.0.2/3.0.6.1 segfaults (28 May 2013)
Updating my argus settup... (27 May 2013)
argus-clients-3.0.7.10 on the dev server (21 May 2013)
Rastream doesn't rotate properly when daemonied? (20 May 2013)
Ra - filter syntax error (20 May 2013)
Anomaly detection (16 May 2013)
raservices crashes when processing (15 May 2013)

Archives

61	June 2013
113	May 2013
38	April 2013
75	March 2013
50	February 2013
113	January 2013
42	December 2012
49	November 2012
155	October 2012
63	September 2012
50	August 2012
30	July 2012
122	June 2012
22	May 2012
37	April 2012
53	March 2012
58	February 2012
91	January 2012
52	December 2011
17	November 2011
30	October 2011
15	September 2011
39	August 2011
49	July 2011
61	June 2011
66	May 2011
82	April 2011
48	March 2011
52	February 2011
27	January 2011
42	December 2010
35	November 2010
72	October 2010
78	September 2010
48	August 2010
102	July 2010
50	June 2010
23	May 2010
61	April 2010
40	March 2010
50	February 2010
26	January 2010
32	December 2009
72	November 2009
48	October 2009
55	September 2009
115	August 2009
66	July 2009
36	June 2009
92	May 2009
122	April 2009
116	March 2009
58	February 2009
26	January 2009
15	December 2008
3	November 2008
3	October 2008
24	September 2008
38	August 2008
50	July 2008
62	June 2008
6	May 2008
61	April 2008
90	March 2008
151	February 2008
121	January 2008
67	December 2007
61	November 2007
120	October 2007
107	September 2007
143	August 2007
44	July 2007
91	June 2007
68	May 2007
82	April 2007
141	March 2007
123	February 2007
69	January 2007
50	December 2006
79	November 2006
113	October 2006
114	September 2006
131	August 2006
96	July 2006
270	June 2006
4	May 2006
4	April 2006
40	March 2006
31	February 2006
24	January 2006
14	December 2005
2	November 2005
1	October 2005
8	September 2005
25	August 2005
1	July 2005
14	June 2005
5	May 2005
25	April 2005
24	March 2005
33	February 2005
12	January 2005
41	December 2004
33	November 2004
35	October 2004
48	September 2004
95	August 2004
45	July 2004
79	June 2004
87	May 2004
84	April 2004
17	March 2004
62	February 2004
14	January 2004
28	December 2003
14	November 2003
15	October 2003
38	September 2003
60	August 2003
28	July 2003
31	June 2003
48	May 2003
24	April 2003
39	March 2003
18	February 2003
29	January 2003
26	December 2002
41	November 2002
47	October 2002
18	September 2002
14	August 2002
23	July 2002
20	June 2002
92	May 2002
29	April 2002
56	March 2002
47	February 2002
33	January 2002
18	December 2001
91	November 2001
58	October 2001
49	September 2001
15	August 2001
49	July 2001
109	June 2001
52	May 2001
39	April 2001
99	March 2001
134	February 2001
123	January 2001
26	December 2000
59	November 2000
72	October 2000
143	September 2000
44	August 2000
81	July 2000
20	June 2000
12	May 2000
11	April 2000
63	March 2000
22	February 2000
8	January 2000
1	December 1999
6	October 1999
15	September 1999
3	August 1999
9	July 1999
12	June 1999
7	May 1999
16	April 1999
28	March 1999
9	February 1999

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template