[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] network sensor 7 performance

Teti Lawrence scribed:
> Robert Graham wrote:
> "In other words, the SensorStatistic value of "tcp.nodataacks" should be
> always zero."
> I am using RSNS 7.0 on Nokia sensors. I do not see a "tcp.nodataacks" in the
> details of my SensorStatistics. I do see a "tcp.drops", which seems to
> always be zero. Why the difference?

The SensorStatistics documentation should include a detailed description
of each stat that is logged in the event.  "tcp.drops" is the total
number of TCP sessions not tracked by PAM, due to a lack of sensor
resources.  This statistic is not related to packet loss.

The statistic which Robert is referring to is now called "tcp.misseddata_gaps".

( Fwiw, this statistic has changed its name over a couple of xpu's,
as the logic behind it has become more refined.  It started as a simple
statistic that tracked the total number of acknowledgements seen on
the wire for which no corresponding data was received by the sensor.
This statistic suffered from the problem that once one tcp segment
was missed by the sensor, the statistic would be incremeneted
for all subsequent acks on the connection (as the acks acknowledge
missed data).  This logic did not yield as meaningful of a statistic
as we had hoped.  So, the logic was refined to track the total number
of tcp gaps, rather than the total number of missed data acks, seen on
each tcp connection.  The name of the statistic was updated accordingly. )

Hope this helps,

Jacob Langseth <jwl@xxxxxxxxx>
ISSForum mailing list

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo