Re: ARGUSBug Argus server occasionally generates an invalid meter DSR in a flow record
[email protected] Wed, 27 Feb 2019 14:14:20 -0500
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_6CF13FE7-7372-4EFE-9BDA-B6D5E4FAED92 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Joel, Can you send a binary argus file that has one of the records in it ??? = Is this record coming directly from argus or is it coming from a client = =E2=80=A6 radium.1 ??? There is a lot of data compression going on with the Meter DSR, and the = client library will attempt to pack the metrics into as little space as = possible, such that, if all the values are less than 256, then all the = metrics are reported as a char array. I suspect that the Meter DSR has = been compressed, but the final type description is getting dropped. What do the argus-clients do with this record =E2=80=A6 do they print = out anything at all or do they jump past this DSR ??? Hope all is going well down in Tennesseeeeeeeeeee land !!!! Carter =20 > On Feb 27, 2019, at 2:01 PM, Reed, Joel via Argus-info = <[email protected]> wrote: >=20 > >Description: > The Argus server occasionally generates a flow record with a meter = DSR that is not properly parsed by the ra client. This causes the = packet, byte, and appbytes counts to be incorrect, usually containing at = least some count values from the previous flow record. Below I have = included a partial dump of the of the problematic flow record. The = meter DSR subtype 0x04 (includes app bytes) has a qualifier of 0x00. = The meter DSR parser (common/argus_client.c:~2223) does not have a case = to process a meter DSR subtype 0x04, qualifier of 0x00. >=20 > Partial hex dump of the flow record: >=20 > 01: 13 20 00 39 -- Type 0x10 (FAR), version 3, 0x20 continuation, = length 0x39 > 02: 01 03 00 03 -- Transport DSR=20 > 03: 00 00 00 00 | > 04: e1 12 61 ff | > 05: 02 01 01 05 -- Flow DSR > 06: a0 5b 56 4a | > 07: a0 5b 5e a9 | > 08: 06 00 03 ff | > 09: 08 01 00 00 | > 0a: 03 02 18 05 -- Time DSR > 0b: 5c 76 ad d0 | > 0c: 00 07 88 2f | > 0d: 5c 76 ad f0 | > 0e: 00 05 41 67 | > 0f: 10 04 00 05 -- Meter DSR, subtype 0x04, qualifier 0x00, length = 0x05 > 10: 30 00 00 01 | > 11: 40 00 01 02 | > 12: 01 f4 00 00 | > 13: 48 00 01 02 | > 14: 30 05 00 1e -- Network DSR > 15: ... >=20 > >How-To-Repeat: > Unknown. We see approximately one of these per hour. >=20 > >Fix: > Unknown. >=20 > >Originator: Joel Reed <[email protected] <mailto:[email protected]>> > >Organization: > ORNL > >ARGUS support: none > >Release: argus-3.0 > >Product: argus > >Synopsis: Argus server occasionally generates an invalid meter = DSR in a flow record > >Class: sw-bug > >Severity: non-critical > >Priority: low >=20 > >Environment: =20 >=20 > ARGUS: Argus Version 3.0.8.2 > RA: Ra Version 3.0.8.2 >=20 --Apple-Mail=_6CF13FE7-7372-4EFE-9BDA-B6D5E4FAED92 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey = Joel,<div class=3D"">Can you send a binary argus file that has one of = the records in it ??? Is this record coming directly from argus = or is it coming from a client =E2=80=A6 radium.1 ???</div><div = class=3D""><br class=3D""></div><div class=3D"">There is a lot of data = compression going on with the Meter DSR, and the client library will = attempt to pack the metrics into as little space as possible, such that, = if all the values are less than 256, then all the metrics are reported = as a char array. I suspect that the Meter DSR has been compressed, = but the final type description is getting dropped.</div><div = class=3D""><br class=3D""></div><div class=3D"">What do the = argus-clients do with this record =E2=80=A6 do they print out anything = at all or do they jump past this DSR ???</div><div class=3D"">Hope = all is going well down in Tennesseeeeeeeeeee land !!!!</div><div = class=3D""><br class=3D""><div class=3D"">Carter<div class=3D""><div = dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: = break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D""> </div> </div> <div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Feb 27, 2019, at 2:01 PM, Reed, Joel via Argus-info <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""> <meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dus-ascii" class=3D""> <div style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;" class=3D""> <div class=3D"">>Description:</div> <div class=3D""> The Argus server occasionally generates a = flow record with a meter DSR that is not properly parsed by the ra = client. This causes the packet, byte, and appbytes counts to be = incorrect, usually containing at least some count values from the previous flow record. Below I have included a partial dump of the = of the problematic flow record. The meter DSR subtype 0x04 = (includes app bytes) has a qualifier of 0x00. The meter DSR parser = (common/argus_client.c:~2223) does not have a case to process a meter DSR subtype 0x04, qualifier of 0x00.</div> <div class=3D""><br class=3D""> </div> <div class=3D""> Partial hex dump of the flow record:</div> <div class=3D""><br class=3D""> </div> <div class=3D""> <font face=3D"Courier New" class=3D""> 01: = 13 20 00 39 -- Type 0x10 (FAR), version 3, 0x20 continuation, length = 0x39</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 02: = 01 03 00 03 -- Transport DSR </font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 03: = 00 00 00 00 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 04: = e1 12 61 ff |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 05: = 02 01 01 05 -- Flow DSR</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 06: = a0 5b 56 4a |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 07: = a0 5b 5e a9 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 08: = 06 00 03 ff |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 09: = 08 01 00 00 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0a: = 03 02 18 05 -- Time DSR</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0b: = 5c 76 ad d0 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0c: = 00 07 88 2f |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0d: = 5c 76 ad f0 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0e: = 00 05 41 67 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 0f: = 10 04 00 05 -- Meter DSR, subtype 0x04, qualifier 0x00, length = 0x05</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 10: = 30 00 00 01 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 11: = 40 00 01 02 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 12: = 01 f4 00 00 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 13: = 48 00 01 02 |</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 14: = 30 05 00 1e -- Network DSR</font></div> <div class=3D""><font face=3D"Courier New" class=3D""> 15: = ...</font></div> <div class=3D""><br class=3D""> </div> <div class=3D"">>How-To-Repeat:</div> <div class=3D""> Unknown. We see approximately one of = these per hour.</div> <div class=3D""><br class=3D""> </div> <div class=3D"">>Fix:</div> <div class=3D""> Unknown.</div> <div class=3D""><br class=3D""> </div> <div class=3D"">>Originator: Joel Reed <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>></div> <div class=3D"">>Organization:</div> <div class=3D""> ORNL</div> <div class=3D"">>ARGUS support: none</div> <div class=3D"">>Release: argus-3.0</div> <div class=3D"">>Product: argus</div> <div class=3D"">>Synopsis: Argus server = occasionally generates an invalid meter DSR in a flow record</div> <div class=3D"">>Class:<span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span> sw-bug</div> <div class=3D"">>Severity: non-critical</div> <div class=3D"">>Priority: low</div> <div class=3D""><br class=3D""> </div> <div class=3D"">>Environment: </div> <div class=3D""><br class=3D""> </div> <div class=3D"">ARGUS: Argus Version 3.0.8.2</div> <div class=3D"">RA: Ra Version 3.0.8.2</div> <div class=3D""><br class=3D""> </div> </div> </div></blockquote></div><br class=3D""></div></div></body></html>= --Apple-Mail=_6CF13FE7-7372-4EFE-9BDA-B6D5E4FAED92--