Re: Question about loss and retransmission reporting
"Balas, Edward G" <[email protected]> Tue, 11 Dec 2018 11:52:31 -0500
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_A7870B9F-01E7-4F38-974F-6AE745A50E2F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Carter,
Ive dug a bit deeper reviewing the original pcap that caught my eye. =
The concern / confusion at this point is that most other utilities =
report similar values ~12,097 whereas Argus is reporting value thats ~ =
500% larger.=20
1. I ran tshark and =E2=80=98manually=E2=80=9D counted multiple =
instances of sequence numbers when tcp.len is greater than 1 ie not an =
ack
accuracy-test]# tshark -r no-vlan.pcap -nn -Y 'tcp.srcport=3D=3D35940 =
and tcp.len > 1' -T fields -e ip.src -e ip.dst -e tcp.dstport -e =
tcp.seq | sort | uniq -dc | wc -l.
12087=20
(this is unique instances not total count, though each sequence number =
showed up twice in spot checking)
2. next I looked at what tshark's own tcp analysis would result in.=20
tshark -r no-vlan.pcap -nn -Y 'tcp.port=3D=3D35940 and =
tcp.analysis.retransmission' -T fields -e ip.src -e ip.dst -e =
tcp.dstport -e tcp.seq | wc -l=20
13610
-this number is is different to be sure but within same order of =
magnitude
3. next we ran this pcap through tcptrace and it also reported 12087=20
4. finally ran argus / racluster is showing the following: =20
accuracy-test]# racluster -n -r no-vlan.argus -M =
dsrs=3D+metric,+asn,+net,+agr,+ipattr -s +trans, +cause, =
+retrans,+loss,+appbytes, dur
StartTime Flgs Proto SrcAddr Sport Dir =
DstAddr Dport TotPkts TotBytes State Trans Cause =
Retrans Loss TotAppByte Dur=20
18:32:30.061403 e s tcp xxx.xxx.123.97.35940 -> =
xxx.xxx.106.139.5201 309477 2089885325 RST 3 Start =
0 66189 2068372573 10.294667
- it should be noted that the metrics for total app bytes, and total =
packets are consistent with other utilities and all were generated from =
the same pcap file.
- ra is unable to return retrans values even though in the source code =
loss is calculated from retrans?
The code path that trigged the 66,189 reported retransmissions is as =
follows:
ArgusTcp.c
if (ArgusThisTCPsrc->win) {
int dipid;
if (*tipid && ((dipid =3D (ipid - *tipid)) < 0) =
&& (dipid > -5000)) {
ArgusThisTCPsrc->status |=3D =
ARGUS_OUTOFORDER;
} else
if (ArgusThisTCPsrc->winbytes > ((maxseq - 1) - =
ArgusThisTCPdst->ack)) {
ArgusThisTCPsrc->retrans++;
ArgusThisTCPsrc->status |=3D =
ARGUS_PKTS_RETRANS;
ArgusThisTCPsrc->winbytes -=3D len;
printf(=E2=80=9CThe code path we are hitting =
is here\n");
model->ArgusInProtocol =3D 0;
} else {
Im not super familiar with the source, could you share a bit as to whats =
going on in this situation? and also any insights as to why loss is =
showing values but not retransmissions is always 0?
Thanks Much!
> On Dec 7, 2018, at 1:45 PM, Balas, Edward G <[email protected]> wrote:
>=20
>=20
>=20
>> On Dec 7, 2018, at 1:21 PM, [email protected] wrote:
>>=20
>> Hey Edward,
>> Its always important to indicate which version your running, so we =
can deal with known bugs etc =E2=80=A6
>=20
> Sorry about that=E2=80=A6 I hadn't gotten to point of thinking there =
was a bug =E2=80=A6
> 3.0.8.2 is what I running now
>=20
>>=20
>> Argus tracks loss in 3 basic conditions, connection oriented =
protocols such as TCP, connection-less protocols that have sequence =
numbers, such as RTP, UDT, and IPSEC, and strict request / response =
protocols where you should see the same out as back.
>>=20
>> Argus has a complete TCP state machine so that it can identify =
requests for missing packets, retransmissions and out of order packets. =
But argus is designed to recognize loss regardless of where it is along =
the path. As a result, the algorithm is a little complex, mainly =
because TCP is reliable and regardless of the loss rate you should =
always see at least one copy of all the packets. Because argus is a =
bi-directional flow monitor, argus can do things like look for requests =
for retransmission as an indication of loss. It can infer that =
observing multiple packets is an indication of loss (you don=E2=80=99t =
retransmit unless there was loss), and it can needs to do this in the =
event of stripping and asymmetric routing.
>=20
> yeah we are defn interesting in the asymmetic situation, for now we =
are validating using point of observation where traffic appears =
symmetric.
>=20
>>=20
>> Because loss can occur before and or after argus see=E2=80=99s the =
packet stream, argus will use retransmissions and retransmission =
requests from the far side as an indication of loss. If the far side =
requests more than once, we assume that the packet was lost more than =
once, or that the retransmission request was lost. This is a possible =
source for argus saying there is more loss than other tools.
>=20
> Ah ok that is in part what I was curious about, so if one were to look =
at the individual packets in a flow and count the number of times any =
sequence number shows up more than once, they should presumably come up =
with the same value as argus loss calc?
>=20
>=20
>> Now with that as a starting point, where is argus in relationship =
with the the other tools, and what methods are they using to determine =
loss ???
>=20
> Yeah this is a classic dilemma have having too many watches and not =
knowing which is correct. What we have for a reference is ultimately =
what iperf3 is reporting, and we are starting to look at what the kernel =
can tell us as presumably the tcp implementation should have a pretty =
authoritiative view of its own behavior, but I havent dug into proc =
filesystem etc enough to know whats available. Im not really sure yet =
what tsharks methodology is for determining retransmission, I have been =
presuming it is similar to what you described, Ill take a look at =
sequence numbers directly to see whats up and report back.
>=20
>>=20
>> Carter
>> =09
>> Carter Bullard =E2=80=A2 CTO
>> 150 E 57th Street, Suite 12D
>> New York, New York 10022-2795
>> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494
>>=20
>>=20
>>=20
>>> On Dec 7, 2018, at 12:28 PM, Balas, Edward G <[email protected]> wrote:
>>>=20
>>> Hey all,
>>>=20
>>> Ive run into an issue Im struggling to understand, and thus far =
googling has failed to right me. I am trying to use Argus to track =
retransmissions / loss in flows and I am getting values that are =
inconsistent with other tools including the sending application. As I =
recurse into the various rabbit holes contributing to this on our end, I =
was wondering if someone could guide me on the following:
>>>=20
>>> 1. within ra etc there is the ability to report loss and retrans. =
When I look at the documentation loss seems to imply it contains both =
retransmissions and dropped packets, if Im looking at a TCP flow, is it =
correct to assume there will be no drops and thus loss is synonymous =
with retransmission?
>>>=20
>>> 2. I am able to get ra and racluster to report loss values for my =
flows, however retrans is always 0, is there a special -M or other =
options or argus option I need to use to see retrans? Im making the =
possibly bad assumption that because I can see loss values the tunings =
of argus are sufficient.
>>>=20
>>> 3. The Loss numbers are always higher than what I am seeing with =
other applications, is there a document or place in the code I should go =
look at that describes how this is calculated?
>>>=20
>>> Motivating these questions is the following small test:
>>> -------------------------------------------------------
>>> I transfered a file to my test host while doing full snaplen packet =
capture, and then compared argus with tshark reports of loss and =
retransmission.=20
>>>=20
>>> accuracy-test2]# argus -JA -r raw.pcap -w raw.argus
>>>=20
>>> accuracy-test2]# racluster -n -r raw.argus -s =
stime,dur,pkts,retrans,loss,appbytes,cause -- port 51170
>>> StartTime Dur TotPkts Retrans Loss TotAppByte =
Cause=20
>>> 16:47:58.176366 15.206044 21513 0 24 20195392 =
Start
>>>=20
>>>=20
>>>=20
>>>=20
>>>>> Total packets between tshark and argus agree:
>>>=20
>>> accuracy-test2]# tshark -r raw.pcap -nn -Y 'tcp.port=3D=3D51170 ' =
| wc -l=20
>>> 21513
>>>=20
>>>>> Retransmissions / loss do not agree between tshark and argus:
>>>=20
>>> accuracy-test2]# tshark -r raw.pcap -nn -Y 'tcp.port=3D=3D51170 and =
tcp.analysis.retransmission ' | wc -l=20
>>> 17
>>>=20
>>> 17 vs 24
>>>=20
>>>=20
>>> Was curious if folks had insights they could share in these regards?
>>>=20
>>> Thanks,
>>>=20
>>> Edward Balas
>>> [email protected]
>>=20
>=20
--Apple-Mail=_A7870B9F-01E7-4F38-974F-6AE745A50E2F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; =
line-break: after-white-space;" class=3D""><font face=3D"Courier" =
class=3D"">Carter,</font><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><font =
face=3D"Courier" class=3D"">Ive dug a bit deeper reviewing the original =
pcap that caught my eye. The concern / confusion at this point is =
that most other utilities report similar values ~12,097 whereas Argus is =
reporting value thats ~ 500% larger. </font></div><div =
class=3D""><font face=3D"Courier" class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><font =
face=3D"Courier" class=3D"">1. I ran tshark and =E2=80=98manually=E2=
=80=9D counted multiple instances of sequence numbers when tcp.len is =
greater than 1 ie not an ack</font></div><div class=3D""><font =
face=3D"Courier" class=3D""><br class=3D""></font></div><div =
class=3D""><font face=3D"Courier" class=3D"">accuracy-test]# =
tshark -r no-vlan.pcap -nn -Y 'tcp.srcport=3D=3D35940 and tcp.len =
> 1' -T fields -e ip.src -e ip.dst -e tcp.dstport -e tcp.seq =
| sort | uniq -dc | wc -l.<br =
class=3D"">12087 </font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><font =
face=3D"Courier" class=3D"">(this is unique instances not total count, =
though each sequence number showed up twice in spot =
checking)</font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""><br class=3D""></font></div><div =
class=3D""><font face=3D"Courier" class=3D"">2. next I looked at what =
tshark's own tcp analysis would result in. </font></div><div =
class=3D""><font face=3D"Courier" class=3D"">tshark -r no-vlan.pcap -nn =
-Y 'tcp.port=3D=3D35940 and tcp.analysis.retransmission' -T fields -e =
ip.src -e ip.dst -e tcp.dstport -e tcp.seq | wc -l <br =
class=3D"">13610</font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><font =
face=3D"Courier" class=3D"">-this number is is different to be sure but =
within same order of magnitude</font></div><div class=3D""><font =
face=3D"Courier" class=3D""><br class=3D""></font></div><div =
class=3D""><font face=3D"Courier" class=3D"">3. next we ran this =
pcap through tcptrace and it also reported 12087 </font></div><div =
class=3D""><font face=3D"Courier" class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D"">4. finally ran argus / racluster is showing the following: =
</font></div><div class=3D""><font face=3D"Courier" class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D"">accuracy-test]# racluster -n -r no-vlan.argus -M =
dsrs=3D+metric,+asn,+net,+agr,+ipattr -s +trans, +cause, =
+retrans,+loss,+appbytes, dur<br class=3D""> =
StartTime Flgs Proto =
SrcAddr Sport Dir =
DstAddr Dport TotPkts =
TotBytes State Trans Cause =
Retrans Loss TotAppByte =
Dur <br class=3D""> 18:32:30.061403 e s =
tcp =
xxx.xxx.123.97.35940 -> =
xxx.xxx.106.139.5201 309477 2089885325 RST =
3 Start 0 =
66189 2068372573 10.294667<br class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D"">- it should be noted that the metrics for total app bytes, =
and total packets are consistent with other utilities and all were =
generated from the same pcap file.</font></div><div class=3D""><font =
face=3D"Courier" class=3D"">- ra is unable to return retrans values even =
though in the source code loss is calculated from =
retrans?</font></div><div class=3D""><font face=3D"Courier" class=3D""><br=
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><font =
face=3D"Courier" class=3D""><br class=3D""></font></div><div =
class=3D""><font face=3D"Courier" class=3D"">The code path that trigged =
the 66,189 reported retransmissions is as follows:</font></div><div =
class=3D""><font face=3D"Courier" class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D"">ArgusTcp.c</font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D""><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 15px; =
line-height: normal; font-family: Menlo; background-color: rgb(235, 233, =
210); min-height: 18px;" class=3D""><span style=3D"font-variant-ligatures:=
no-common-ligatures" class=3D""></span><br class=3D""></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 15px; =
line-height: normal; font-family: Menlo; background-color: rgb(235, 233, =
210);" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""> =
</span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #bf6d15" =
class=3D"">if</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""> (ArgusThisTCPsrc->win) =
{</span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 15px; line-height: normal; font-family: Menlo; =
background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
</span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #19ad11" class=3D"">int</span><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
dipid;</span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 15px; line-height: normal; font-family: Menlo; =
background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
</span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #bf6d15" class=3D"">if</span><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
(*tipid && ((dipid =3D (ipid - *tipid)) < </span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #b82c18" =
class=3D"">0</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">) && (dipid > -</span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #b82c18" =
class=3D"">5000</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">)) {</span></div><div style=3D"margin: =
0px; font-stretch: normal; font-size: 15px; line-height: normal; =
font-family: Menlo; background-color: rgb(235, 233, 210);" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
ArgusThisTCPsrc->status |=3D =
ARGUS_OUTOFORDER;</span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 15px; line-height: normal; font-family: Menlo; =
background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
} </span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #bf6d15" class=3D"">else</span></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 15px; =
line-height: normal; font-family: Menlo; background-color: rgb(235, 233, =
210);" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""> =
</span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #bf6d15" =
class=3D"">if</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""> (ArgusThisTCPsrc->winbytes > =
((maxseq - </span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #b82c18" class=3D"">1</span><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">) - =
ArgusThisTCPdst->ack)) {</span></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 15px; line-height: normal; font-family: =
Menlo; background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
=
ArgusThisTCPsrc->retrans++;</span></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 15px; line-height: normal; font-family: =
Menlo; background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
ArgusThisTCPsrc->status |=3D =
ARGUS_PKTS_</span><span style=3D"font-variant-ligatures: =
no-common-ligatures; background-color: #e6e600" =
class=3D"">RETRANS</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">;</span></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 15px; line-height: normal; font-family: =
Menlo; background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
ArgusThisTCPsrc->winbytes -=3D =
len;</span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 15px; line-height: normal; font-family: Menlo; =
background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
printf(</span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #b82c18" =
class=3D"">=E2=80=9CThe code path we are hitting is here</span><span =
style=3D"font-variant-ligatures: no-common-ligatures; color: #c82bc7" =
class=3D"">\n</span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #b82c18" class=3D"">"</span><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D"">);</span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 15px; line-height: normal; font-family: Menlo; =
background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
model->ArgusInProtocol =3D =
</span><span style=3D"font-variant-ligatures: no-common-ligatures; =
color: #b82c18" class=3D"">0</span><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">;</span></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 15px; line-height: normal; font-family: =
Menlo; background-color: rgb(235, 233, 210); min-height: 18px;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""></span><br class=3D""></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 15px; line-height: normal; font-family: =
Menlo; background-color: rgb(235, 233, 210);" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
} </span><span style=3D"font-variant-ligatures: =
no-common-ligatures; color: #bf6d15" class=3D"">else</span><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
{</span></div></div><div class=3D""><span style=3D"font-variant-ligatures:=
no-common-ligatures" class=3D""><br class=3D""></span></div><div =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""><br class=3D""></span></div><div class=3D"">Im not super =
familiar with the source, could you share a bit as to whats going on in =
this situation? and also any insights as to why loss is showing =
values but not retransmissions is always 0?</div><div class=3D""><font =
face=3D"Courier" class=3D""><br class=3D""></font></div><div =
class=3D""><font face=3D"Courier" class=3D""><br =
class=3D""></font></div><div class=3D""><font face=3D"Courier" =
class=3D""><br class=3D""></font></div><div class=3D"">Thanks Much!<br =
class=3D""><br class=3D""></div><div class=3D""><br class=3D""></div><div =
class=3D""><br class=3D""></div><div class=3D""><br class=3D""><blockquote=
type=3D"cite" class=3D"">On Dec 7, 2018, at 1:45 PM, Balas, Edward G =
<<a href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> =
wrote:<br class=3D""><br class=3D""><br class=3D""><br =
class=3D""><blockquote type=3D"cite" class=3D"">On Dec 7, 2018, at 1:21 =
PM, <a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a> wrote:<br class=3D""><br class=3D"">Hey =
Edward,<br class=3D"">Its always important to indicate which version =
your running, so we can deal with known bugs etc =E2=80=A6<br =
class=3D""></blockquote><br class=3D"">Sorry about that=E2=80=A6 I =
hadn't gotten to point of thinking there was a bug =E2=80=A6<br =
class=3D"">3.0.8.2 is what I running now<br class=3D""><br =
class=3D""><blockquote type=3D"cite" class=3D""><br class=3D"">Argus =
tracks loss in 3 basic conditions, connection oriented protocols such as =
TCP, connection-less protocols that have sequence numbers, such as =
RTP, UDT, and IPSEC, and strict request / response protocols where you =
should see the same out as back.<br class=3D""><br class=3D"">Argus has =
a complete TCP state machine so that it can identify requests for =
missing packets, retransmissions and out of order packets. But =
argus is designed to recognize loss regardless of where it is along the =
path. As a result, the algorithm is a little complex, mainly =
because TCP is reliable and regardless of the loss rate you should =
always see at least one copy of all the packets. Because argus is =
a bi-directional flow monitor, argus can do things like look for =
requests for retransmission as an indication of loss. It can infer =
that observing multiple packets is an indication of loss (you =
don=E2=80=99t retransmit unless there was loss), and it can needs to do =
this in the event of stripping and asymmetric routing.<br =
class=3D""></blockquote><br class=3D"">yeah we are defn interesting in =
the asymmetic situation, for now we are validating using point of =
observation where traffic appears symmetric.<br class=3D""><br =
class=3D""><blockquote type=3D"cite" class=3D""><br class=3D"">Because =
loss can occur before and or after argus see=E2=80=99s the packet =
stream, argus will use retransmissions and retransmission requests from =
the far side as an indication of loss. If the far side requests =
more than once, we assume that the packet was lost more than once, or =
that the retransmission request was lost. This is a possible =
source for argus saying there is more loss than other tools.<br =
class=3D""></blockquote><br class=3D"">Ah ok that is in part what I was =
curious about, so if one were to look at the individual packets in a =
flow and count the number of times any sequence number shows up more =
than once, they should presumably come up with the same value as argus =
loss calc?<br class=3D""><br class=3D""><br class=3D""><blockquote =
type=3D"cite" class=3D"">Now with that as a starting point, where is =
argus in relationship with the the other tools, and what methods are =
they using to determine loss ???<br class=3D""></blockquote><br =
class=3D"">Yeah this is a classic dilemma have having too many watches =
and not knowing which is correct. What we have for a reference is =
ultimately what iperf3 is reporting, and we are starting to look at what =
the kernel can tell us as presumably the tcp implementation should have =
a pretty authoritiative view of its own behavior, but I havent dug =
into proc filesystem etc enough to know whats available. Im not =
really sure yet what tsharks methodology is for determining =
retransmission, I have been presuming it is similar to what you =
described, Ill take a look at sequence numbers directly to =
see whats up and report back.<br class=3D""><br =
class=3D""><blockquote type=3D"cite" class=3D""><br class=3D"">Carter<br =
class=3D""> <span =
class=3D"Apple-tab-span" style=3D"white-space:pre"> =
</span> <span class=3D"Apple-tab-span" style=3D"white-space:pre"> =
</span><br class=3D"">Carter Bullard =E2=80=A2 CTO<br =
class=3D"">150 E 57th Street, Suite 12D<br class=3D"">New York, New York =
10022-2795<br class=3D"">Phone +1.212.588.9133 =E2=80=A2 Mobile =
+1.917.497.9494<br class=3D""><br class=3D""><br class=3D""><br =
class=3D""><blockquote type=3D"cite" class=3D"">On Dec 7, 2018, at 12:28 =
PM, Balas, Edward G <<a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>> wrote:<br class=3D""><br class=3D"">Hey =
all,<br class=3D""><br class=3D"">Ive run into an issue Im struggling to =
understand, and thus far googling has failed to right me. I am =
trying to use Argus to track retransmissions / loss in flows and I am =
getting values that are inconsistent with other tools including the =
sending application. As I recurse into the various =
rabbit holes contributing to this on our end, I was wondering if =
someone could guide me on the following:<br class=3D""><br class=3D"">1. =
within ra etc there is the ability to report loss and retrans. =
When I look at the documentation loss seems to imply it contains =
both retransmissions and dropped packets, if Im looking at a TCP flow, =
is it correct to assume there will be no drops and thus loss is =
synonymous with retransmission?<br class=3D""><br class=3D"">2. =
I am able to get ra and racluster to report loss values for my =
flows, however retrans is always 0, is there a special -M or other =
options or argus option I need to use to see retrans? Im making =
the possibly bad assumption that because I can see loss values the =
tunings of argus are sufficient.<br class=3D""><br class=3D"">3. =
The Loss numbers are always higher than what I am seeing with =
other applications, is there a document or place in the code I should go =
look at that describes how this is calculated?<br class=3D""><br =
class=3D"">Motivating these questions is the following small test:<br =
class=3D"">-------------------------------------------------------<br =
class=3D"">I transfered a file to my test host while doing full snaplen =
packet capture, and then compared argus with tshark reports of loss and =
retransmission. <br class=3D""><br class=3D"">accuracy-test2]# =
argus -JA -r raw.pcap -w raw.argus<br class=3D""><br =
class=3D"">accuracy-test2]# racluster -n -r raw.argus -s =
stime,dur,pkts,retrans,loss,appbytes,cause -- port 51170<br =
class=3D""> StartTime =
Dur TotPkts Retrans Loss TotAppByte =
Cause <br class=3D""> 16:47:58.176366 15.206044 =
21513 0 24 =
20195392 Start<br class=3D""><br class=3D""><br =
class=3D""><br class=3D""><br class=3D""><blockquote type=3D"cite" =
class=3D""><blockquote type=3D"cite" class=3D"">Total packets between =
tshark and argus agree:<br class=3D""></blockquote></blockquote><br =
class=3D"">accuracy-test2]# tshark -r raw.pcap -nn -Y =
'tcp.port=3D=3D51170 ' | wc -l <br class=3D"">21513<br =
class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><blockquote=
type=3D"cite" class=3D"">Retransmissions / loss do not agree between =
tshark and argus:<br class=3D""></blockquote></blockquote><br =
class=3D"">accuracy-test2]# tshark -r raw.pcap -nn -Y =
'tcp.port=3D=3D51170 and tcp.analysis.retransmission ' | wc =
-l <br class=3D"">17<br class=3D""><br class=3D"">17 vs 24<br =
class=3D""><br class=3D""><br class=3D"">Was curious if folks had =
insights they could share in these regards?<br class=3D""><br =
class=3D"">Thanks,<br class=3D""><br class=3D"">Edward Balas<br =
class=3D""><a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a><br class=3D""></blockquote><br =
class=3D""></blockquote><br class=3D""></blockquote><br =
class=3D""></div></body></html>=
--Apple-Mail=_A7870B9F-01E7-4F38-974F-6AE745A50E2F--