Vern Paxson wrote:
puzzled over ipsumdump because the difference in connection number
is big and the tool does not give you any hint about the existence of a
problem, thus it is easy to get a wrong analysis with bro.
Hmmmm - we make heavy use of ipsumdump for trace analysis, and haven't run
across this sort of problem before. If you can put together a demonstration
of the problem, send it to Eddie Kohler <kohler(a)cs.ucla.edu> (the ipsumdump
developer), he's quite responsive in fixing bugs. Also, cc me on the note,
as I'd like to understand the issue better.
I used to use ipsumdump to stitch together multiple pcap files into one, but
have found on occasion that it doesn't always output in timestamp sorted order.
Don't have a testcase right now, but IIRC, it occurred if using a large number
Consequently, I wrote a little utility 'tcpsort', which although it has its
deficiencies (in memory sort of timestamps which restricts total size of input
files, and two passes thru the input files) works for the purpose of stitching
multiple pcap files together in timestamp sorted order. I can post if if
Lawrence Berkeley National Laboratory
The reason you are having computer problems is:
knot in cables caused data stream to become twisted and kinked