Debian pkg and packet loss metrics

Zeek
1

Hey,

Two questions, too lazy to write two messages:

1. There was some talk about bro 1.6 having the means to easily generate
Debian packages with cmake. I see scripts for generating rpm packages
and scripts for generating mac packages, but nothing for Debian. Does
anyone have pointers on how to do this, or should I plan on generating
something in house?

2. How are people non-intrusively measuring packet loss in their
clusters? I can get a vague idea of what bro is losing via netstats,
but I'd hate to interfere with cluster operations by running it every
few minutes. We also split our taps with Click router, so that still
wouldn't tell me what, if anything, Click or the kernel itself are
losing. (For the record, the kernel and Click both claim to be losing
close to nothing, while bro loses ~3-4%, based on a few tests I've
done.)

Thanks,

-Lou

2

1. There was some talk about bro 1.6 having the means to easily
generate Debian packages with cmake. I see scripts for generating rpm
packages and scripts for generating mac packages, but nothing for Debian.
Does anyone have pointers on how to do this, or should I plan on
generating something in house?

DEB packages as generated by CMake/CPack weren't initially targeted because they lacked the ability to automatically determine the package's dependency meta-info, which was a big turn-off. However, it looks as though this capability works in more recent CMake/CPack versions, so I'm going to look into it again:

http://tracker.bro-ids.org/bro/ticket/458

If it works out, these will probably be of a "working" quality, but not of a quality that would be accepted into a public package repository.

- Jon

3

Take a look at policy/capture-loss.bro. That count ACKs for sequence
numbers above a gap, which gives quite a good indicator of loss.

Robin