ARGUSBug Argus server occasionally generates an invalid meter DSR in a flow record
"Reed, Joel via Argus-info" <[email protected]> Wed, 27 Feb 2019 19:01:13 +0000
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--_000_A379F88036804D8191005FB120CC79B3ornlgov_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
>Description:
The Argus server occasionally generates a flow record with a meter DSR t=
hat is not properly parsed by the ra client. This causes the packet, byte,=
and appbytes counts to be incorrect, usually containing at least some coun=
t values from the previous flow record. Below I have included a partial du=
mp of the of the problematic flow record. The meter DSR subtype 0x04 (incl=
udes app bytes) has a qualifier of 0x00. The meter DSR parser (common/argu=
s_client.c:~2223) does not have a case to process a meter DSR subtype 0x04,=
qualifier of 0x00.
Partial hex dump of the flow record:
01: 13 20 00 39 -- Type 0x10 (FAR), version 3, 0x20 continuation, lengt=
h 0x39
02: 01 03 00 03 -- Transport DSR
03: 00 00 00 00 |
04: e1 12 61 ff |
05: 02 01 01 05 -- Flow DSR
06: a0 5b 56 4a |
07: a0 5b 5e a9 |
08: 06 00 03 ff |
09: 08 01 00 00 |
0a: 03 02 18 05 -- Time DSR
0b: 5c 76 ad d0 |
0c: 00 07 88 2f |
0d: 5c 76 ad f0 |
0e: 00 05 41 67 |
0f: 10 04 00 05 -- Meter DSR, subtype 0x04, qualifier 0x00, length 0x05
10: 30 00 00 01 |
11: 40 00 01 02 |
12: 01 f4 00 00 |
13: 48 00 01 02 |
14: 30 05 00 1e -- Network DSR
15: ...
>How-To-Repeat:
Unknown. We see approximately one of these per hour.
>Fix:
Unknown.
>Originator: Joel Reed <[email protected]<mailto:[email protected]>>
>Organization:
ORNL
>ARGUS support: none
>Release: argus-3.0
>Product: argus
>Synopsis: Argus server occasionally generates an invalid meter DSR in=
a flow record
>Class: sw-bug
>Severity: non-critical
>Priority: low
>Environment:
ARGUS: Argus Version 3.0.8.2
RA: Ra Version 3.0.8.2
--_000_A379F88036804D8191005FB120CC79B3ornlgov_
Content-Type: text/html; charset="us-ascii"
Content-ID: <[email protected]>
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; line-break:=
after-white-space;" class=3D"">
<div class=3D"">>Description:</div>
<div class=3D""> The Argus server occasionally generates a flow=
record with a meter DSR that is not properly parsed by the ra client. &nbs=
p;This causes the packet, byte, and appbytes counts to be incorrect, usuall=
y containing at least some count values from the
previous flow record. Below I have included a partial dump of the of=
the problematic flow record. The meter DSR subtype 0x04 (includes ap=
p bytes) has a qualifier of 0x00. The meter DSR parser (common/argus_=
client.c:~2223) does not have a case to process
a meter DSR subtype 0x04, qualifier of 0x00.</div>
<div class=3D""><br class=3D"">
</div>
<div class=3D""> Partial hex dump of the flow record:</div>
<div class=3D""><br class=3D"">
</div>
<div class=3D""> <font face=3D"Courier New" class=3D""> 01: 13 =
20 00 39 -- Type 0x10 (FAR), version 3, 0x20 continuation, length 0x39</fon=
t></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 02: 01 0=
3 00 03 -- Transport DSR </font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 03: 00 0=
0 00 00 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 04: e1 1=
2 61 ff |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 05: 02 0=
1 01 05 -- Flow DSR</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 06: a0 5=
b 56 4a |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 07: a0 5=
b 5e a9 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 08: 06 0=
0 03 ff |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 09: 08 0=
1 00 00 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0a: 03 0=
2 18 05 -- Time DSR</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0b: 5c 7=
6 ad d0 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0c: 00 0=
7 88 2f |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0d: 5c 7=
6 ad f0 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0e: 00 0=
5 41 67 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 0f: 10 0=
4 00 05 -- Meter DSR, subtype 0x04, qualifier 0x00, length 0x05</font></div=
>
<div class=3D""><font face=3D"Courier New" class=3D""> 10: 30 0=
0 00 01 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 11: 40 0=
0 01 02 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 12: 01 f=
4 00 00 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 13: 48 0=
0 01 02 |</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 14: 30 0=
5 00 1e -- Network DSR</font></div>
<div class=3D""><font face=3D"Courier New" class=3D""> 15: ...<=
/font></div>
<div class=3D""><br class=3D"">
</div>
<div class=3D"">>How-To-Repeat:</div>
<div class=3D""> Unknown. We see approximately one of the=
se per hour.</div>
<div class=3D""><br class=3D"">
</div>
<div class=3D"">>Fix:</div>
<div class=3D""> Unknown.</div>
<div class=3D""><br class=3D"">
</div>
<div class=3D"">>Originator: Joel Reed <<a href=3D"mailto:reedjw@ornl=
.gov" class=3D"">[email protected]</a>></div>
<div class=3D"">>Organization:</div>
<div class=3D""> ORNL</div>
<div class=3D"">>ARGUS support: none</div>
<div class=3D"">>Release: argus-3.0</div>
<div class=3D"">>Product: argus</div>
<div class=3D"">>Synopsis: Argus server occasionally=
generates an invalid meter DSR in a flow record</div>
<div class=3D"">>Class:<span class=3D"Apple-tab-span" style=3D"white-spa=
ce:pre"> </span>
sw-bug</div>
<div class=3D"">>Severity: non-critical</div>
<div class=3D"">>Priority: low</div>
<div class=3D""><br class=3D"">
</div>
<div class=3D"">>Environment: </div>
<div class=3D""><br class=3D"">
</div>
<div class=3D"">ARGUS: Argus Version 3.0.8.2</div>
<div class=3D"">RA: Ra Version 3.0.8.2</div>
<div class=3D""><br class=3D"">
</div>
</body>
</html>
--_000_A379F88036804D8191005FB120CC79B3ornlgov_--