Re: Malfunctioning of argus -S option for some pcaps

--000000000000998bb2058cbde890
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks Carter, that saves life!!!!

Could you help me understand one more bit about -S option: when implemting
this report interval (-S), I guess argus uses one timer for all flows
instead of a seperate timer for each flow right?

Thanks,
-Hang

On Tue, Jul 2, 2019 at 6:28 PM <[email protected]> wrote:

> Hey Hang,
> The problem is that your packets are not in time order, so argus is doing
> the right thing.  Best example is around packet # 3848, where the packet
> timestamps jumps back 6.5 hours.  Nothing argus can do with that but tall=
y
> the packets =E2=80=A6 and all the flows will be messed up for a little wh=
ile, until
> the packet timestamps move ahead in front of the largest startime.  If yo=
u
> can get the packets sorted in time, then things should work fine.
>
> Carter
>
> On Jul 2, 2019, at 4:19 PM, Hang Guo <[email protected]> wrote:
>
> Hi,
>
> I found argus -S option malfunctioning for some pcaps. For example, when
> running argus -S 10 with the pcap attached (MAC and IP anamoyzed, payload
> dropped for privacy), instead of reportting every 5-tuple flows every 10
> seconds, duration of some reported 5-tuple flows (as pasted below) are
> hundreds of seconds. Just wonder what is the possible cause and is there =
a
> fix to this?
>
> argus -S 10 -r dur_test_anon.pcapng -w - | ra -c "," -r - -s dur | sort
>> -nr | head -5
>> 4865.550781
>> 296.601562
>> 296.393066
>> 294.411255
>> 292.840790
>
>
> Thanks,
> -Hang
> <dur_test_anon.pcapng>
>
>
>

--000000000000998bb2058cbde890
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks Carter, that saves life!!!!<div><br></div><div>Coul=
d you help me understand one more bit about -S option: when implemting this=
 report interval (-S), I guess argus uses one timer for all flows instead o=
f a seperate timer for each flow right?</div><div><br></div><div>Thanks,</d=
iv><div>-Hang=C2=A0</div></div><br><div class=3D"gmail_quote"><div dir=3D"l=
tr" class=3D"gmail_attr">On Tue, Jul 2, 2019 at 6:28 PM &lt;<a href=3D"mail=
to:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: break=
-word;">Hey Hang,<div>The problem is that your packets are not in time orde=
r, so argus is doing the right thing.=C2=A0 Best example is around packet #=
 3848, where the packet timestamps jumps back 6.5 hours.=C2=A0 Nothing argu=
s can do with that but tally the packets =E2=80=A6 and all the flows will b=
e messed up for a little while, until the packet timestamps move ahead in f=
ront of the largest startime.=C2=A0 If you can get the packets sorted in ti=
me, then things should work fine.</div><div><br><div>Carter<br>
<div><br><blockquote type=3D"cite"><div>On Jul 2, 2019, at 4:19 PM, Hang Gu=
o &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]<=
/a>&gt; wrote:</div><br class=3D"gmail-m_4501021760447724577Apple-interchan=
ge-newline"><div><div dir=3D"ltr">Hi,<div><br></div><div><div>I found argus=
 -S option malfunctioning for some pcaps. For example, when running argus -=
S 10 with the pcap attached (MAC and IP anamoyzed, payload dropped for priv=
acy), instead of reportting every 5-tuple flows every 10 seconds, duration =
of some reported 5-tuple flows (as pasted below) are hundreds of seconds. J=
ust wonder what is the possible cause and is there a fix to this?</div><div=
><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.=
8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">argus -S 10 -r=
 dur_test_anon.pcapng -w - | ra -c &quot;,&quot; -r - -s dur | sort -nr | h=
ead -5<br>4865.550781<br>296.601562<br>296.393066<br>294.411255<br>292.8407=
90</blockquote><div><br></div><div>Thanks,</div><div>-Hang=C2=A0</div></div=
></div>
<span id=3D"gmail-m_4501021760447724577cid:f_jxm9ab750">&lt;dur_test_anon.p=
capng&gt;</span></div></blockquote></div><br></div></div></div></blockquote=
></div>

--000000000000998bb2058cbde890--