Re: Malfunctioning of argus -S option for some pcaps
[email protected] Wed, 3 Jul 2019 10:04:48 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_FDF8D269-C179-45C9-8BB3-49DBBD8CC52F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Hang, Each flow cache that is being tracked is placed in a single "status=E2=80=9D= queue, in start time order. The end of the queue is used to manage the = status interval. The output processor just looks at the end of this = queue to decide if it's time to report the flow cache's values. This = saves having to manage a timer for each flow cache, which can number in = the millions. Of course, each flow cache entry has an independent timestamp, the first = packet=E2=80=99s timestamp, which is the =E2=80=9Cstart time". This = works, because argus, as a real-time flow sensor, reads packets off the = wire, where all the packets MUST come in in time order (nature of = networking a time stamping each packet as it comes in, using the same = clock). When argus reads packets from a file, or a stream of packets = from a distributed packet broker, it gets a little weird, as the arrival = of packets are not real-time, and can be delayed, shaped and / or = reordered. =20 To deal with the weirdness, argus uses a very specific strategy. When = not reading realtime packets using a real-time sensor, you have to = decide if you want to =E2=80=9Cbelieve" the timestamp in the packet or = do you instead use the realtime system clock when argus receives the = packet (whenever that might be). Argus uses the timestamp provided by = the packet capture facility as the realtime clock, and plays a lot of = games trying to figure out what to do next when there are gaps in time. = The reasons are huge, from a practical perspective, as you want = deterministic results when processing packets. The only requirement is = that the packets come in mostly in time order. Carter =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <http://qosient.com/> =09 Carter Bullard=C2=A0=C2=A0 <mailto:[email protected]>=E2=80=A2 = Chairman / Founder / CTO 150 E 57th Street, Suite 12D New York, New York 10022-2795 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 =20 > On Jul 2, 2019, at 10:48 PM, Hang Guo <[email protected]> wrote: >=20 > Thanks Carter, that saves life!!!! >=20 > Could you help me understand one more bit about -S option: when = implemting this report interval (-S), I guess argus uses one timer for = all flows instead of a seperate timer for each flow right? >=20 > Thanks, > -Hang=20 >=20 > On Tue, Jul 2, 2019 at 6:28 PM <[email protected] = <mailto:[email protected]>> wrote: > Hey Hang, > The problem is that your packets are not in time order, so argus is = doing the right thing. Best example is around packet # 3848, where the = packet timestamps jumps back 6.5 hours. Nothing argus can do with that = but tally the packets =E2=80=A6 and all the flows will be messed up for = a little while, until the packet timestamps move ahead in front of the = largest startime. If you can get the packets sorted in time, then = things should work fine. >=20 > Carter >=20 >> On Jul 2, 2019, at 4:19 PM, Hang Guo <[email protected] = <mailto:[email protected]>> wrote: >>=20 >> Hi, >>=20 >> I found argus -S option malfunctioning for some pcaps. For example, = when running argus -S 10 with the pcap attached (MAC and IP anamoyzed, = payload dropped for privacy), instead of reportting every 5-tuple flows = every 10 seconds, duration of some reported 5-tuple flows (as pasted = below) are hundreds of seconds. Just wonder what is the possible cause = and is there a fix to this? >>=20 >> argus -S 10 -r dur_test_anon.pcapng -w - | ra -c "," -r - -s dur | = sort -nr | head -5 >> 4865.550781 >> 296.601562 >> 296.393066 >> 294.411255 >> 292.840790 >>=20 >> Thanks, >> -Hang=20 >> <dur_test_anon.pcapng> >=20 --Apple-Mail=_FDF8D269-C179-45C9-8BB3-49DBBD8CC52F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey = Hang,<div class=3D"">Each flow cache that is being tracked is placed in = a single "status=E2=80=9D queue, in start time order. The end of = the queue is used to manage the status interval. The output = processor just looks at the end of this queue to decide if it's time to = report the flow cache's values. This saves having to manage a = timer for each flow cache, which can number in the millions.</div><div = class=3D""><br class=3D""></div><div class=3D"">Of course, each flow = cache entry has an independent timestamp, the first packet=E2=80=99s = timestamp, which is the =E2=80=9Cstart time". This works, because = argus, as a real-time flow sensor, reads packets off the wire, where all = the packets MUST come in in time order (nature of networking a time = stamping each packet as it comes in, using the same clock). When = argus reads packets from a file, or a stream of packets from a = distributed packet broker, it gets a little weird, as the arrival of = packets are not real-time, and can be delayed, shaped and / or = reordered. </div><div class=3D""><br class=3D""></div><div = class=3D"">To deal with the weirdness, argus uses a very specific = strategy. When not reading realtime packets using a real-time = sensor, you have to decide if you want to =E2=80=9Cbelieve" the = timestamp in the packet or do you instead use the realtime system clock = when argus receives the packet (whenever that might be). Argus = uses the timestamp provided by the packet capture facility as the = realtime clock, and plays a lot of games trying to figure out what to do = next when there are gaps in time. The reasons are huge, from a = practical perspective, as you want deterministic results when processing = packets. The only requirement is that the packets come in mostly = in time order.</div><div class=3D""><br class=3D""></div><div = class=3D""><div class=3D"">Carter<br class=3D""><div class=3D""> <div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, = 0); letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: = break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D""><div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: = rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: = break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D""><table id=3D"sig" width=3D"360" cellspacing=3D"0" = cellpadding=3D"0" border-spacing=3D"0" style=3D"width: 360px; margin: = 0px; padding: 0px;" class=3D""><tbody class=3D""><tr class=3D""><td = width=3D"142" style=3D"width: 142px; margin: 0px; padding: 0px;" = class=3D""><a href=3D"http://qosient.com" title=3D"QoSient" = style=3D"border: none; text-decoration: none;" class=3D""><img = src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAR8AAABdCAYAAACcsGKeA= AAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAACy9JREFUeNrsndt140YShmt= 85n2RgbERCI5gMBEMNgLBEZiOQHAEtCOgHIFGEZCKgNoIyI2AzMArnGkcy5jqC9DVF4D/dw4eR= ElEo6vr7+oLqokAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBN8CGTctSaz1/= frivMlJTi7apGn53VBcBixKdW193bVTKNWsfQ2F/eroO6QDixad+uT8pWheFvX9U12OUs2Ebe2= /4RZgFzaN6u3dt1ebv+EryelJMUqGIRSmUnH5scBWzSjb5zD9OAqb1n34hOwoLDXRflNCWqXcz= hJWyynWkTiA/wasiXCKLDXTtEQpM7iWPgjqGB+IAY8zmukc5e9Yyt+r/S8J2NapBPjqLW/80G5= rBSWex1Ujbi7FMpu2wdxKuD+ICQbCPO0dSOc0h7REHGiOdiEJ12xnyRbpgN8QHJwvZQ8zHDqsz= JEgVVMNN3HA228mVsE4gPiB627ynOJHBB9gnTFubSOneoOhpEaKr41Op/hgu2y48yZadeGcL2S= 6IGU1qiMDTib3XE1c02YMeAyHN9beiSKiI1Cc+R0i957yBAk+rmCH8CM6ZZ9ilufqH8J3hbgwA= 1N9x4ONvV8Ckwo/OKLj4hJypjCdCtTkLXxK9sAeA64km2ELA1RDy50hqGh7e2DN9RvLkesP7Oa= 5/qxkty4o7iTrLmyhNhDgwsUHxOmuFLuWDH++vGhl97wnwPyEh8fnCMHDiR+ZmWk9OlL+tVM5Q= EACTAJj79kOoX5vOv6loKvfD8qlHzW+798foJyFZ8NpoG+usCn/WR+CRkDzdiay5KxQZAkC3cX= M9uwc9T0+3O/XSEDYZAzne853w+Gn7Xb8Yrmc9/W3AF9pHPKyM29+rzGFRMNBkjV/WBifIq1ag= ON+5Y3GsgueYPrxdSTiumHM59hNOOPuvnef6z8IbWMtFbPyT5d6D79SL+RTXuykEgXlQ9hxDDC= yN8/T0/Z+Zc9cg2j8L3KEd20c19XVX9PCubSDl5Z/l53EHcqzqpLOV8UXV1negPpcPf/TjSg94= uf07o+CZ1cNyQaw2vJhQRhl4l+eetPpL8PpyOZBJ+xRwe7gPYxSddr8Qk/fi7daKzn1nObkI59= xQ+w+ik9lVpvmQtcBW+ERK2TthwJ5JbkTO9m9etXHyk7CKRKdPmV51Qu6lyFp+PBvHhQqe18MI= 4dH9UzO+eczk7B4NfmSFVbemt96psvquM/b37PU9PzO8eVB0saf+Wq+A+OQj4wdEm/ff1+8Pul= D2k51t2lojXtZylip5/tgxbXyfUY2Vpxzomtacu89BcYl5BcuWnIXN+o536m8IiXhsy5ySSyhy= wFQzbc458TJk2hxzVlUX4N6RPmjf39SJd5LPTlLOzlLNSz6Jrg3UAnwn2esWe1p2KohAcVrYBn= Lg2hMNS79PZ5j5SiZCU+OiE5zKzI201zn0UEp8d+SflKzR2vZBM7vRk4lPTuuAcrvA0iHQK2Y1= gg5/iUNzermZh4vOkqTefhYVSI2hbz7bXCEe4G5LfnxdNfCQcM3eOngJbahxXehOmLnOk1HtpJ= bmvAA1DgDJz8dkEjBh1k/a1h39dArQfTnzLpYrP2vCN7vYUb/d3ReGzEE4RoeFZ6wzFhxMH6Qw= MNfklZjPVqeTUwkXw+yE+mYgPN8/zFLi8vg1+igh15L5HSXo/kq/47CjOfCV3n9bDv0I485YRY= YjPwsXnxIhAjGFpR3ETgrXkvg/kJFQWH/EpKF6mzdKjAwoxIexaxgris1zxaSntSuCJ4udhLlU= v6nIctu9ku4/4bCjuQgk3r1LM8K8mYnvZ5C4+F+HJqhw5zXzGPaV9Mzy1+LlEQz5J+n3E5xhZm= OfaImbHPhbILhfx0eXzedX0fmuCe56zw/+Me9I/Ipf7kSnnl8j3/6yug2H4s6e4qUq4N9NDJ7z= jvv9TZu38v7mWTyc+15WLzxzhIU0InyKj41eHcoXmoARIl6K2oHhHZpNG6F4C3/PKtJvcckOdc= 3XCHxzVsuduReJTzTTSHeOAKXKpPDNimmofVh8J/aSJlocdtzGoHedkpK+SeWaIj/Cwq16R+Hy= a2UtWkXtWU9ThIqgxG/hnQ7tpI5ThXxl3bGCC+Oga91p2OTeOz2wbrqXMIHfNbFh8VQLE1ckDn= B6M+WhoSFy60Ybks8ql6Jk4EZkjPq8Jn+N1FI2WGdTtcErIjqm3KnJ99e30T7j48sSHlOG4XMd= LF5975rOvaAqiTv/AiGETWXz+R8hNvchhl84h64WHt4Vm/uEZTUGUJSxBg4zF56zpOX5Z8PNy5= 5CdEfmI8+wwZAUQHyPcMTktLXPlS3f66pRNgufRzymjwMpStpSk2KQ6Xnn8Ee69bPE5aKKfJZ5= xzp080E+QPnqIT6oGXmgiuFzI4RwpRFoLFx9d9NP3ut2CnrMhfnn9t4mOMiXxe0hqx2jjljhkY= hsgKD69Ubk5kQdaxuTzcKoE56xTT6t4Yb47RQ/7hXmWnE6tTLEf7FXT6YAFi0+P7v2dPeW98bA= g/UFvc46hOWTSwBuHcqUWfIpcRm6v1j1cfPniM5z3xDl3rgJkerP695nOcGWiwNirfy1T37ltp= uOGPOcI931mRLqEm68DXY5fqeTcksJzNJTV17FSnWnWP9eJ0uYTcoHLldQ6/m9HfpkMLxQp6ZU= HMfP51EL1UedQryanzqGXKQ1llEokvie55FlT2JJfGtUYZWzJL01oR/I5nDcQn3WIT2Fx7jpxu= G86ObQKZNAY0R/n1FMbwCWwIxaaqGdKWg1f8dEdbRNDeCvH+6xBfE6pnNwkQCmOVi7IfgSwdOP= bRhSgRuiZpA81tEWEc6LNjsKc2xU6Ot1M6HzXID5J87rbBOgUKQpqyZzYPFSj0z2/tAC1mudqZ= 3wX10lIHaS3E+qIOiFn0Qmh9OpkObrXLYlPmVqAbNni9hRmOdomOhLH47o0vEug4acpmpubHTD= EmeymObY5DV1KfEyd41ZAdAvizzdbq/gUFPfYptkNRhcJbT2dslGO53KgnUQDcx3nXwzOV88wc= mv4Tp+0pLYTJ7YTxLq0DHXnRoBS4mPqHN6fM1bMsPfW8L1rFR8ifqW1cLRDRwHnGyvLMIxzzK0= qVKMq6f3VqN/tyP3guqFC6sjia3v2QXgbjXPXyhFswrqNZKOTKks3skmrPjs62GCu8EuKjy0yG= 0R3R/oXpoe26HJumatzLVV8OtKfWFsy992MRkZdaEd0GQ6FuKROzAw5BJ17Sc9VtOR+HPLUa+c= ZcUqLT2jbDGWcMrxfqvjY5nltVxfLGVvPgrpeT5TXOzy1sPj6OrOpIW0Ey3oSskMI8Xk/bJe0z= XHmMy9VfGzTDNmIz3iMfBIWnA3lvXW+nThc5IYCsZ6v8YgMTsQnactRfCQ6xsE2PkP7JYvPnEj= yRMyixofIDlnS3xuxPhF/yuSY/m3lM307S+xAy8vLWyjnvnv37AXzjP17Yy8ZPGNjsc97e3wl+= VQe5Uh0rxQuXUj5zjalRlAOqgyS7a9m7hGy/VWB6rP/3nv6Pr3yWV0vgdqIKNtIcx0AAMD2uKY= l6xJVBAAIOSwzjcVj7d0BANwoHZkn/DqIEAAgZBRkWy3qVx18Xp9oIGIAAJNA2Jbph6W8Ka8GD= C9CdqhiAOLzYUFlbYk/hnfMsJT4Qt8vKw5LyMMKWv+7z5RX8nUAQMYiJLFzekp2PQAA+EcU4/q= Ge+zEUgCAG2FIteH6CkeLKgMAhIiINkqMuOFZhyoCID0fbuQ5a/o2v1PS9FNKAQAAAAAAAAAAA= AAAAAAAAAAAAAAASM3/BRgAaVGndQa4eeAAAAAASUVORK5CYII=3D" alt=3D"QoSient" = style=3D"border: none; height: 48px; font-family: "Gill Sans", = sans-serif; font-weight: 100; font-size: 48px; line-height: 48px; color: = rgb(0, 0, 0);" class=3D""><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span></a><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span></td><td width=3D"20" = style=3D"width: 16px; min-width: 16px; max-width: 16px; margin: 0px; = padding: 0px;" class=3D""> </td><td style=3D"margin: 0px; padding: = 0px; border-collapse: collapse;" class=3D""><table id=3D"sig2" = cellspacing=3D"0" cellpadding=3D"0" border-spacing=3D"0" class=3D""><tbody= class=3D""><tr class=3D""><td style=3D"font-family: "Gill Sans = Light", sans-serif; white-space: nowrap;" class=3D""><a = href=3D"mailto:[email protected] " style=3D"border: none; = text-decoration: none;" class=3D""><span style=3D"font-size: 16px; = line-height: 16px; color: rgb(0, 0, 176);" class=3D"">Carter = Bullard</span><span class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span></a><span style=3D"font-size:= 12px; line-height: 14px; color: rgb(0, 0, 0);" class=3D"">=E2=80=A2</span= ><span class=3D"Apple-converted-space"> </span><span = class=3D"Apple-converted-space"> </span><span style=3D"font-size: = 12px; line-height: 14px; color: rgb(0, 0, 0);" class=3D"">Chairman / = Founder / CTO</span></td></tr><tr class=3D""><td style=3D"font-family: = "Gill Sans Light", sans-serif; white-space: nowrap;" = class=3D""><span style=3D"font-size: 12px; line-height: 14px; color: = rgb(0, 0, 0);" class=3D"">150 E 57th Street, Suite = 12D</span></td></tr><tr class=3D""><td style=3D"font-family: "Gill = Sans Light", sans-serif; white-space: nowrap;" class=3D""><span = style=3D"font-size: 12px; line-height: 14px; color: rgb(0, 0, 0);" = class=3D"">New York, New York 10022-2795</span></td></tr><tr = class=3D""><td style=3D"font-family: "Gill Sans Light", = sans-serif; white-space: nowrap;" class=3D""><span style=3D"font-size: = 12px; line-height: 12px; color: rgb(0, 0, 0);" class=3D"">Phone = +1.212.588.9133 =E2=80=A2 Mobile = +1.917.497.9494</span></td></tr></tbody></table></td></tr><tr = class=3D""></tr></tbody></table><br class=3D""> </div></div> </div> <div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Jul 2, 2019, at 10:48 PM, Hang Guo <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"ltr" class=3D"">Thanks Carter, that saves life!!!!<div = class=3D""><br class=3D""></div><div class=3D"">Could you help me = understand one more bit about -S option: when implemting this report = interval (-S), I guess argus uses one timer for all flows instead of a = seperate timer for each flow right?</div><div class=3D""><br = class=3D""></div><div class=3D"">Thanks,</div><div = class=3D"">-Hang </div></div><br class=3D""><div = class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jul = 2, 2019 at 6:28 PM <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br = class=3D""></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: = break-word;" class=3D"">Hey Hang,<div class=3D"">The problem is that = your packets are not in time order, so argus is doing the right = thing. Best example is around packet # 3848, where the packet = timestamps jumps back 6.5 hours. Nothing argus can do with that = but tally the packets =E2=80=A6 and all the flows will be messed up for = a little while, until the packet timestamps move ahead in front of the = largest startime. If you can get the packets sorted in time, then = things should work fine.</div><div class=3D""><br class=3D""><div = class=3D"">Carter<br class=3D""> <div class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Jul 2, 2019, at 4:19 PM, Hang Guo <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"gmail-m_4501021760447724577Apple-interchange-newline"><div = class=3D""><div dir=3D"ltr" class=3D"">Hi,<div class=3D""><br = class=3D""></div><div class=3D""><div class=3D"">I found argus -S option = malfunctioning for some pcaps. For example, when running argus -S 10 = with the pcap attached (MAC and IP anamoyzed, payload dropped for = privacy), instead of reportting every 5-tuple flows every 10 seconds, = duration of some reported 5-tuple flows (as pasted below) are hundreds = of seconds. Just wonder what is the possible cause and is there a fix to = this?</div><div class=3D""><br class=3D""></div><blockquote = class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex">argus -S 10 -r = dur_test_anon.pcapng -w - | ra -c "," -r - -s dur | sort -nr | head = -5<br class=3D"">4865.550781<br class=3D"">296.601562<br = class=3D"">296.393066<br class=3D"">294.411255<br = class=3D"">292.840790</blockquote><div class=3D""><br = class=3D""></div><div class=3D"">Thanks,</div><div = class=3D"">-Hang </div></div></div> <span id=3D"gmail-m_4501021760447724577cid:f_jxm9ab750" = class=3D""><dur_test_anon.pcapng></span></div></blockquote></div><br= class=3D""></div></div></div></blockquote></div> </div></blockquote></div><br class=3D""></div></div></body></html>= --Apple-Mail=_FDF8D269-C179-45C9-8BB3-49DBBD8CC52F--