From netramet-owner Mon Aug 3 09:23:18 1998

From netramet-owner Mon Aug 3 09:23:18 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id JAA15524
for netramet-outgoing; Mon, 3 Aug 1998 09:15:36 +1200 (NZST)
Received: from n.browlee5.itss.auckland.ac.nz (n.brownlee5.itss.auckland.ac.nz [130.216.4.79])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with SMTP id JAA15518
for <[email protected]>; Mon, 3 Aug 1998 09:15:34 +1200 (NZST)
From: Nevil Brownlee <[email protected]>
To: [email protected]
Subject: configure.in error
Message-ID: <[email protected]>
Date: Mon, 3 Aug 1998 09:19:18 +1200 (New Zealand Standard Time)
Priority: NORMAL
X-Mailer: Simeon for Win32 Version 4.1.4 Build (40)
X-Authentication: none
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: [email protected]
Precedence: bulk

To: [email protected]
Subject: configure.in error
X-Dog: Basset
X-Car: MGB Mark II
X-Attribution: NPG
Organization: BT Labs (http://www.labs.bt.com)
Mime-Version: 1.0 (generated by tm-edit 7.106)
Content-Type: multipart/mixed;
boundary="Multipart_Fri_Jul_31_13:16:40_1998-1"
Content-Transfer-Encoding: 7bit
From: Nicolai P Guba <[email protected]>
Date: 31 Jul 1998 13:16:40 +0100
Message-ID: <[email protected]>
Lines: 48
X-Mailer: Gnus v5.5/Emacs 20.2

--Multipart_Fri_Jul_31_13:16:40_1998-1
Content-Type: text/plain; charset=US-ASCII

I didn't have libpcap installed, so autoconf reported an error. What I got
wasn't the error message, but

NeTraMet: command not found

instead.

Oops :)

The attached patch fixes this problem.

Happy Hacking!
--
Nicolai P Guba, BSc(Hons) BT Networks and Systems
Managerial Professional Grade Applied Research and Technology
BT Research Laboratories Distributed Systems Group
Martlesham Heath, Suffolk IP5 3RE pp B54/R73

--Multipart_Fri_Jul_31_13:16:40_1998-1
Content-Type: application/octet-stream; type=patch
Content-Disposition: attachment; filename="netramet-configure-fix.diff"
Content-Transfer-Encoding: 7bit

*** /tmp/configure.in Fri Jul 31 11:01:16 1998
--- /tmp/configure.ina15073 Fri Jul 31 11:01:16 1998
***************
*** 27,33 ****
AC_CHECK_LIB(socket, socket)
AC_CHECK_LIB(nsl, inet_ntoa)
AC_CHECK_LIB(resolv, res_query)
! AC_CHECK_LIB(pcap, pcap_major_version,PCAP=-lpcap ,NetraMet requires libpcap;exit 1)
AC_PATH_XTRA
AC_HEADER_STDC
AC_HEADER_TIME
--- 27,33 ----
AC_CHECK_LIB(socket, socket)
AC_CHECK_LIB(nsl, inet_ntoa)
AC_CHECK_LIB(resolv, res_query)
! AC_CHECK_LIB(pcap, pcap_major_version,PCAP=-lpcap ,echo "NetraMet requires libpcap library and header files";exit 1)
AC_PATH_XTRA
AC_HEADER_STDC
AC_HEADER_TIME

--Multipart_Fri_Jul_31_13:16:40_1998-1--

From netramet-owner Tue Aug 11 21:54:45 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id VAA28471
for netramet-outgoing; Tue, 11 Aug 1998 21:49:18 +1200 (NZST)
Received: from nosc.ja.net (nosc.ja.net [128.86.16.20])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with SMTP id VAA28464
for <[email protected]>; Tue, 11 Aug 1998 21:49:15 +1200 (NZST)
Received: from nosc.ja.net by nosc.ja.net with Internet SMTP
id <[email protected]>; Tue, 11 Aug 1998 10:48:49 +0100
To: [email protected]
From: Kevin Hoadley <[email protected]>
Subject: Duplicate rules
Date: Tue, 11 Aug 1998 10:48:47 +0100
Message-ID: <[email protected]>
Sender: [email protected]
Precedence: bulk

Anyone know what happens if you have a ruleset like this:

DestPeerAddress & 255.255.0.0 = 1.2.0.0 : GotoAct, label_1;
DestPeerAddress & 255.255.0.0 = 1.2.0.0 : GotoAct, label_2;

I know that in the simplest case control flow is top down, and the second
rule will never get parsed. However if there are a number of rules with the
same field,mask then according to the documentation they are optimised into
a hash table - thus the question is whether in building the hash table the
code checks to see whether there is already an entry for field/mask (ie
whether it discards rule 2 above when it finds it already has rule 1 in the
hash table), or whether the second rule simply overwrites the first in the
hash table ?

(I know the above ruleset is daft, but the context is a system that
machine generates rulesets with limited intelligence)

Kevin Hoadley, JANET.

From netramet-owner Wed Aug 12 05:24:11 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id FAA14665
for netramet-outgoing; Wed, 12 Aug 1998 05:22:59 +1200 (NZST)
Received: from enst.enst.fr (enst.enst.fr [137.194.2.16])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id FAA14657
for <[email protected]>; Wed, 12 Aug 1998 05:22:54 +1200 (NZST)
Received: from email.enst.fr (email.enst.fr [137.194.168.17])
by enst.enst.fr (8.8.8/8.8.8) with ESMTP id TAA21432
for <[email protected]>; Tue, 11 Aug 1998 19:22:40 +0200 (MET DST)
Received: from nikopol.enst.fr (nikopol.enst.fr [137.194.168.105])
by email.enst.fr (8.8.8/8.8.8) with ESMTP id TAA07171
for <[email protected]>; Tue, 11 Aug 1998 19:22:26 +0200 (MET DST)
Received: from localhost (paulausk@localhost)
by nikopol.enst.fr (8.8.8/8.8.8) with SMTP id TAA23256
for <[email protected]>; Tue, 11 Aug 1998 19:22:24 +0200 (MET DST)
X-Authentication-Warning: nikopol.enst.fr: paulausk owned process doing -bs
Date: Tue, 11 Aug 1998 19:22:23 +0200 (MET DST)
From: Darius Paulauskas <[email protected]>
To: [email protected]
Subject: Problem:Address already in use
In-Reply-To: <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: [email protected]
Precedence: bulk

Hello ,

Then I try to run NeTraMet I get following message:
bind: Address already in use .

Finally I think I found where is a problem but I'm
not sure and it is not clear for me how to bypass it.

In file meter_ux.c there is certain variable INADDR_ANY.
And I think it cause me problems. In file netinet/in.h
it is defined as (u_long)0x00000000 . Should I need to change
bit of source code in meter_ux.c , or just write in place of
INADDR_ANY some over value(again in meter_ux.c file)?
I will be thankful for any suggestion.

Darius
koniec sviazi

From netramet-owner Wed Aug 12 08:48:47 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id IAA26651
for netramet-outgoing; Wed, 12 Aug 1998 08:47:55 +1200 (NZST)
Received: from n.browlee5.itss.auckland.ac.nz (n.brownlee5.itss.auckland.ac.nz [130.216.4.79])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with SMTP id IAA26621;
Wed, 12 Aug 1998 08:47:46 +1200 (NZST)
From: Nevil Brownlee <[email protected]>
To: Kevin Hoadley <[email protected]>
Cc: [email protected], [email protected]
Subject: Re: Duplicate rules
In-Reply-To: <[email protected]>
Message-ID: <[email protected]>
Date: Wed, 12 Aug 1998 08:54:16 +1200 (New Zealand Standard Time)
Priority: NORMAL
X-Mailer: Simeon for Win32 Version 4.1.4 Build (40)
X-Authentication: none
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: [email protected]
Precedence: bulk

Hello Kevin:

On Tue, 11 Aug 1998 10:48:47 +0100 Kevin Hoadley <[email protected]>
wrote (to the NeTraMet list):

> Anyone know what happens if you have a ruleset like this:
>
> DestPeerAddress & 255.255.0.0 = 1.2.0.0 : GotoAct, label_1;
> DestPeerAddress & 255.255.0.0 = 1.2.0.0 : GotoAct, label_2;

NeMaC doesn't attempt to check for duplicate address&mask pairs, so
both rules go into the meter's rule table. When the ruleset is started
the meter builds hash tables for groups of rules with the same
attribute and mask, so both the above give the same hash value. Again,
the meter doesn't check for this, which means it will just make
duplicate entries in the hash chain. This works OK, but it wastes
processor cycles.

Version 4.2 of NeTraMet is now available (in the top level directory of
the NeTraMet distribution sites). I'm still working on documentation,
but the code and the 4.2 users' guide are there, ready for use.

Version 4.2 includes NetFlowMet, a version of the Unix NeTraMet which
takes its data from a Cisco router using Cisco's NetFlow data.

It also include 'srl,' an optimising compiler for SRL, the Simple
RUleset Language. The SRL syntax is explained in an Internet Draft
(copy on the NeTraMet distribution sites), and is a structured
language with compound statements and IF-THEN-ELSE statements. The
distribution includes a directory of sample srl programs. The
language also allows you to specify a list of IP networks as a sequence
of address/width pairs, and to test an attribute to determine whether
its value matches any of those in such an 'operand list.' Finally (it
took me a long time to get here!), given tests of such operand lists,
the compiler will find and remove duplicate address/mask pairs, and
sort the tests into increasing mask width order. In doing the sort it
also looks for overlapping addresses (which it warns you about), and
makes sure that more-specific addresses are tested before less-specific
ones.

In short, the SRL compiler makes it much, much easier to create and
maintain rulesets.

One word of caution - I have tested the compiler very carefully, and
we're using it here at Auckland to generate our production rulesets.
Please bear in mind that this is the first released version - send me
email about any problems you encounter. The compiler output is a
ruleset ready to be downloaded by NeMaC, so it's not difficult to read
through it to check that it's been translated correctly.

Cheers, Nevil

+---------------------------------------------------------------------+
| Nevil Brownlee Director, Technology Development |
| Phone: +64 9 373 7599 x8941 ITSS, The University of Auckland |
| FAX: +64 9 373 7425 Private Bag 92019, Auckland, New Zealand |
+---------------------------------------------------------------------P

From netramet-owner Wed Aug 12 22:53:12 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id WAA27007
for netramet-outgoing; Wed, 12 Aug 1998 22:49:47 +1200 (NZST)
Received: from firewall.uk.dmg.deuba.com (firewall.uk.dmg.deuba.com [194.196.205.2])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with SMTP id WAA26996
for <[email protected]>; Wed, 12 Aug 1998 22:49:43 +1200 (NZST)
Received: by firewall.uk.dmg.deuba.com (AIX 4.1/UCB 5.64/db1.1)
id AA65778; Wed, 12 Aug 1998 11:42:58 +0100
Received: from imr1.srv.uk.deuba.com(10.141.44.110) by firewall via smap (V1.3)
id sma086730; Wed Aug 12 11:42:52 1998
Received: from bmr1-e1.srv.uk.deuba.com by imr1.srv.uk.deuba.com
id LAA20816; Wed, 12 Aug 1998 11:48:18 +0100 (BST)
Received: from pow.srv.uk.deuba.com by bmr1-e1.srv.uk.deuba.com
id LAA03203; Wed, 12 Aug 1998 11:48:17 +0100 (BST)
Received: from trillian.ksfw.eur.deuba.com by pow.srv.uk.deuba.com
id LAA06452; Wed, 12 Aug 1998 11:48:17 +0100 (BST)
Received: (from goedel@localhost)
by trillian.ksfw.eur.deuba.com (8.8.8/8.8.8/Debian/GNU) id MAA23249;
Wed, 12 Aug 1998 12:46:13 +0200
From: "Stefan G�del" <[email protected]>
Date: Wed, 12 Aug 1998 12:46:12 +0200 (CEST)
To: Darius Paulauskas <[email protected]>
Cc: [email protected]
Subject: Re: Problem:Address already in use
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
X-Mailer: VM 6.43 under 20.4 "Emerald" XEmacs Lucid
Message-Id: <[email protected]>
Mime-Version: 1.0 (generated by tm-edit 7.108)
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Sender: [email protected]
Precedence: bulk

Darius Paulauskas writes:
> =

> Hello ,
> =

> Then I try to run NeTraMet I get following message:
> bind: Address already in use .

I get this error message every time i forget to kill the
SNMP-daemon. They are using the same port and thus can't run at the
same time.

______________________________________________________________________
Stefan G=F6del <[email protected]> Deutsche Bank AG (Eschborn)

This message and any statements expressed therein are those of myself
and not of the Deutsche Bank AG or its subsidiary companies.

From netramet-owner Mon Aug 17 09:48:34 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id JAA08435
for netramet-outgoing; Mon, 17 Aug 1998 09:44:38 +1200 (NZST)
Received: from guerilla.jungle.bt.co.uk ([132.146.129.45])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id JAA08387
for <[email protected]>; Mon, 17 Aug 1998 09:44:18 +1200 (NZST)
Received: by guerilla.jungle.bt.co.uk
id m0z8AXr-000GXMC
(Debian Smail-3.2.0.101 1997-Dec-17 #2); Sun, 16 Aug 1998 22:40:59 +0100 (BST)
To: "Stefan G�del" <[email protected]>
Cc: Darius Paulauskas <[email protected]>, [email protected]
Subject: Re: Problem:Address already in use
References: <[email protected]> <[email protected]> <[email protected]>
X-Dog: Basset
X-Car: MGB Mark II
X-Attribution: NPG
Organization: BT Labs (http://www.labs.bt.com)
Mime-Version: 1.0 (generated by tm-edit 7.106)
Content-Type: text/plain; charset=US-ASCII
From: Nicolai P Guba <[email protected]>
Date: 16 Aug 1998 22:40:59 +0100
In-Reply-To: "Stefan G�del"'s message of Wed, 12 Aug 1998 12:46:12 +0200 (CEST)
Message-ID: <[email protected]>
Lines: 19
X-Mailer: Gnus v5.5/Emacs 20.2
Sender: [email protected]
Precedence: bulk

"SG" == Stefan G�del <[email protected]> writes:

SG> Darius Paulauskas writes:
>> Hello ,
>>
>> Then I try to run NeTraMet I get following message: bind: Address already
>> in use .

SG> I get this error message every time i forget to kill the
SG> SNMP-daemon. They are using the same port and thus can't run at the same
SG> time.

Wouldn't the -m <portno> swich choose a different snmp port (161) instead?

--
Nicolai P Guba, BSc(Hons) BT Networks and Systems
Managerial Professional Grade Applied Research and Technology
BT Research Laboratories Distributed Systems Group
Martlesham Heath, Suffolk IP5 3RE pp B54/R73

From netramet-owner Tue Aug 18 04:09:16 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id EAA08216
for netramet-outgoing; Tue, 18 Aug 1998 04:06:07 +1200 (NZST)
Received: from arthur.axion.bt.co.uk (arthur.axion.bt.co.uk [132.146.5.4])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id DAA07778;
Tue, 18 Aug 1998 03:57:42 +1200 (NZST)
Received: from rambo (actually rambo.futures.bt.co.uk)
by arthur.axion.bt.co.uk (PP) with SMTP;
Mon, 17 Aug 1998 16:41:53 +0100
Received: from mussel.futures.bt.co.uk (actually mussel) by rambo
with SMTP (PP); Mon, 17 Aug 1998 16:43:44 +0100
Received: by mussel.futures.bt.co.uk with Microsoft Exchange (IMC 4.0.837.3)
id <[email protected]>;
Mon, 17 Aug 1998 16:37:31 +0100
Message-ID: <c=GB%a=_%p=BT%[email protected]>
X-MS-TNEF-Correlator: <c=GB%a=_%p=BT%[email protected]>
From: Mansur Khan <[email protected]>
To: "'rtfm'" <[email protected]>, "'netramet'" <[email protected]>,
"'r.street'" <[email protected]>,
"'majordomo'" <[email protected]>
Subject: URGENT PROBLEM
Date: Mon, 17 Aug 1998 16:42:43 +0100
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.837.3
Encoding: 13 TEXT, 34 UUENCODE
X-MS-Attachment: WINMAIL.DAT 0 00-00-1980 00:00
Sender: [email protected]
Precedence: bulk

I am having difficulty building the NeTraMet42 version. I get the following
error message, any possible solutions???

"checking whether the C compiler (gcc ) works.....no
configure:error: installation or configuration problem: C compiler cannot
create executables."

Regards,

Mansur
++44 1473 649511

begin 600 WINMAIL.DAT
M>)\^(B /`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`06 `P`.````S@<(`!$`
M$ `J`"L``0!4`0$@@ ,`#@```,X'" `1`! `)0`?``$`0P$!"8 !`"$```!$
M-S,W1# X.44Q,S5$,C$Q0C4S,3 X,# R0D(P.4)&1@`0!P$-@ 0``@````(`
M`@`!!( !``\```!54D=%3E0@4%)/0DQ%30`&! $#D 8`< 0``!D````#``80
M^!6O?P,`!Q#[````'@`($ $```!E````24%-2$%624Y'1$E&1DE#54Q464)5
M24Q$24Y'5$A%3D544D%-150T,E9%4E-)3TY)1T545$A%1D],3$]724Y'15)2
M3U)-15-304=%+$%.65!/4U-)0DQ%4T],551)3TY3/S\_(@`````#`! 0````
M``,`$1 ``````@$)$ $```"6`0``D@$``&("``!,6D9U6>K6\O\`"@$/`A4"
MI /D!>L"@P!0$P-4`@!C: K <V5T[C(&``;#`H,R`\8'$P*#(C,/>FAE; ,@
M1&SJ9P*#-!,-?0J ",\)V0\"@ J!#;$+8&YG,3 >,Q0@"PH5P@'0($D@*&%M
M(!' =@N 9R "9 :09FEC=6QT<'D@8G4#$!NP&X%T0Q3P![%4<F%-$@`T71(@
M=@20`) "("X:X6?O$@`<XP(0%1!O`_ ;@020IP-@!< '@7-A'I L&P#2;AQ
M<&\$$&D"8!T0DG,&\'5T'B%S/R(`6PJ%"H4B$; %D&L;<G=/%/ <\07 '/)#
M( 6@;09P`Q D`2AG8V,@1BDCH 6P:W,N)>)N5F\*A06@;AO@9PAP9=(Z'[,Z
M( N <P&0%1"Z82&R( 6Q)L8H1' #8.TA,6TGL"1Y8P!P)C %0,T%`&4H0!T0
M97@%D"&@%P&@(4 ET"(B/%)E9^D+$7,L(CQ-`'$(< J%`"LK-#0@,30W`#,@
M-C0Y-3$QOPJ/"Y$2\AK!,+46P0`S$ ``'@!P``$````/````55)'14Y4(%!2
M3T),14T```(!<0`!````%@````&]R?67P_G'K>$UK1'2OU0`8)<%5G,``$ `
M.0!!`K2L]<F]`0,`\3\)! ```P`F```````#`#8```````(!1P`!````+P``
M`&,]1T([[email protected] ]0E0[;#U-3$(T3E1!4S Q+3DX,#@Q-S$U-#(T,UHM,C$Q
M,C8```(!^3\!````2@````````#<IT#(P$(0&K2Y" `K+^&"`0`````````O
M3SU"5"]/53U!051-04E,+T-./5)%0TE0245.5%,O0TX]34%.4U52+DM(04X`
M```>`/@_`0````P```!-86YS=7(@2VAA;@`"`?L_`0```$H`````````W*=
MR,!"$!JTN0@`*R_A@@$`````````+T\]0E0O3U4]04%434%)3"]#3CU214-)
M4$E%3E13+T-./4U!3E-54BY+2$%.````'@#Z/P$````,````36%N<W5R($MH
M86X`0 `',$$"M*SUR;T!0 `(,'!E8?+TR;T!`P`--/T_```"`10T`0```! `
M``!4E*' *7\0&Z6'" `K*B47'@`]``$````!``````````L`*0``````"P`C
M```````"`7\``0```$D````\8SU'0B5A/5\E<#U"5"5L/4U,0C1.5$%3,#$M
M.3@P.#$W,34T,C0S6BTR,3$R-D!M=7-S96PN9G5T=7)E<RYB="YC;RYU:SX`
%````NADW
`
end

From netramet-owner Thu Aug 20 02:16:56 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id CAA25839
for netramet-outgoing; Thu, 20 Aug 1998 02:13:40 +1200 (NZST)
Received: from arthur.axion.bt.co.uk (arthur.axion.bt.co.uk [132.146.5.4])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id CAA25448;
Thu, 20 Aug 1998 02:02:50 +1200 (NZST)
Received: from rambo (actually rambo.futures.bt.co.uk)
by arthur.axion.bt.co.uk (PP) with SMTP;
Wed, 19 Aug 1998 15:02:19 +0100
Received: from mussel.futures.bt.co.uk (actually mussel) by rambo
with SMTP (PP); Wed, 19 Aug 1998 14:47:17 +0100
Received: by mussel.futures.bt.co.uk with Microsoft Exchange (IMC 4.0.837.3)
id <[email protected]>;
Wed, 19 Aug 1998 14:41:07 +0100
Message-ID: <c=GB%a=_%p=BT%[email protected]>
X-MS-TNEF-Correlator: <c=GB%a=_%p=BT%[email protected]>
From: Mansur Khan <[email protected]>
To: "'rtfm'" <[email protected]>, "'r.street'" <[email protected]>,
"'nevil'" <[email protected]>,
"'netramet'" <[email protected]>
Subject: Problem with nifty
Date: Wed, 19 Aug 1998 14:46:23 +0100
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.837.3
Encoding: 12 TEXT, 33 UUENCODE
X-MS-Attachment: WINMAIL.DAT 0 00-00-1980 00:00
Sender: [email protected]
Precedence: bulk

I have now got NeTraMet42 and NetFlowMet42 running on my Unix box.

But I can't get Nifty to run. It gives the following error message:-

" ld.so.1: ./nifty: fatal: libXm.so.3: can't open file: errno=2
Killed "

Thanks for your help so far,

Mansur

begin 600 WINMAIL.DAT
M>)\^(@@-`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`06 `P`.````S@<(`!,`
M#@`N`!<``P!&`0$@@ ,`#@```,X'" `3``X`*0`&``,`, $!"8 !`!\```!&
M,$1%030T0C,W1#(Q,4(U,S$P.# P,D)",#E"1D8`O 8!#8 $``(````"``(`
M`02 `0`3````4')O8FQE;2!W:71H(&YI9G1Y`/<&`0.0!@!,! ``&0````,`
M!A /\?;P`P`'$,$````>``@0`0```&4```!)2$%614Y/5T=/5$Y%5%)!3454
M-#)!3D1.151&3$]73454-#)254Y.24Y'3TY-655.25A"3UA"551)0T%.5$=%
M5$Y)1E195$]254Y)5$=)5D535$A%1D],3$]724Y'15)23U)-``````,`$! `
M`````P`1$ `````"`0D0`0```&T!``!I`0``$0(``$Q:1G7YB$G7_P`*`0\"
M%0*D`^0%ZP*#`% 3`U0"`&-H"L!S973N,@8`!L,"@S(#Q@<3`H,B,P]Z:&5L
M`R!$;/IG`H!]"H (SPG9`H *@8,-L0M@;F<Q,#,4($<+"A+R`= @22 1P':0
M92!N;P?@9V\%0*$'P%1R84T2`#02(*4`<&0'L71&%@!W&P18<G5N`P`8(" "
M(""0;7D@50,`>" &X,QX+@J%"H5"=05 &<#J8P!P)P5 9Q(`![ &D-)T'3!T
M;QQB+AFP'V'6:1H`!"!T%/ @`A 5$#\:0!RR!) #8 7 !X%S80D?@#HM'>PB
M(&QD`"YS;RXQ.B @G"XO`P`?X21P9F$!D()L)'!L:6)8;20BYC,D<!\D;W )
M\"%@`Q!G(M B`AHP/3(*A22 2U\#$"<P&X CT!WL5!' ;NYK!" "$ 7 >0AA
M&= 5`$QP("0P)2%R+!WL32\`<0AP'>P5D0`N`````!X`< `!````$P```%!R
M;V)L96T@=VET:"!N:69T>0```@%Q``$````6`````;W+=ZQ62BC/L3=+$=*_
M5@!@EP56<P``0 `Y`"#'S<!WR[T!`P#Q/PD$```#`"8```````,`-@``````
M`@%'``$````O````8SU'0CMA/2 [<#U"5#ML/4U,0C1.5$%3,#$M.3@P.#$Y
M,3,T-C(S6BTR,S4Y,P```@'Y/P$```!*`````````-RG0,C 0A :M+D(`"LO
MX8(!`````````"]//4)4+T]5/4%!5$U!24PO0TX]4D5#25!)14Y44R]#3CU-
M04Y355(N2TA!3@```!X`^#\!````# ```$UA;G-U<B!+:&%N``(!^S\!````
M2@````````#<IT#(P$(0&K2Y" `K+^&"`0`````````O3SU"5"]/53U!051-
M04E,+T-./5)%0TE0245.5%,O0TX]34%.4U52+DM(04X````>`/H_`0````P`
M``!-86YS=7(@2VAA;@! ``<P6GU"[G;+O0% ``@PP+5)!'?+O0$#``TT_3\`
M``(!%#0!````$ ```%24H< I?Q ;I8<(`"LJ)1<>`#T``0````$`````````
M"P`I```````+`",```````(!?P`!````20```#QC/4=")6$]7R5P/4)4)6P]
M34Q"-$Y405,P,2TY.# X,3DQ,S0V,C-:+3(S-3DS0&UU<W-E;"YF=71U<F5S
0+F)T+F-O+G5K/@`````^"SDQ
`
end

From netramet-owner Thu Aug 20 21:56:34 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id VAA07733
for netramet-outgoing; Thu, 20 Aug 1998 21:53:21 +1200 (NZST)
Received: from taurus.cus.cam.ac.uk (taurus.cus.cam.ac.uk [131.111.8.48])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id VAA07719;
Thu, 20 Aug 1998 21:53:10 +1200 (NZST)
Received: from ajms by taurus.cus.cam.ac.uk with local-smtp (Exim 2.02 #1)
id 0z9RNr-0006Nz-00; Thu, 20 Aug 1998 10:51:55 +0100
To: Mansur Khan <[email protected]>
cc: "'r.street'" <[email protected]>,
"'nevil'" <[email protected]>,
"'netramet'" <[email protected]>
Subject: Re: Problem with nifty
In-reply-to: Your message of "Wed, 19 Aug 1998 14:46:23 BST."
<c=GB%a=_%p=BT%[email protected]>
Date: Thu, 20 Aug 1998 10:51:54 +0200
From: Tony Stoneley <[email protected]>
Message-Id: <[email protected]>
Sender: [email protected]
Precedence: bulk

>" ld.so.1: ./nifty: fatal: libXm.so.3: can't open file: errno=2
> Killed "

Solaris2 by any chance? Coincidentally I tripped over the same problem
yesterday. If so -

libXm.so.3 is in /usr/dt/lib. The run-time linker needs to be directed
to look there. The easy fix is to add /usr/dt/lib to the
LD_LIBRARY_PATH environment variable prior to execution. To avoid the
necessity for this run-time human action add " -R/usr/dt/lib" after
"-L/usr/dt/lib" in autoconf/manager/Makefile and re-make nifty. Of
course the Makefile change will be blown away when configure is
re-run, and the more thorough fix is the same change in
autoconf/configure, or ultimately (for the author) in
autoconf/configure.in.

--
Tony Stoneley Email: [email protected]
Computing Service Phone: +44 1223 334710
Cambridge University

From netramet-owner Fri Aug 21 11:00:39 1998
Received: by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) id KAA26141
for netramet-outgoing; Fri, 21 Aug 1998 10:58:42 +1200 (NZST)
Received: from xroads.vthrc.uq.edu.au (xroads.vthrc.uq.edu.au [130.102.4.16])
by mailhost.auckland.ac.nz (8.9.1/8.9.1/8.9.1-ua) with ESMTP id KAA26132
for <[email protected]>; Fri, 21 Aug 1998 10:58:37 +1200 (NZST)
Received: (from fwtk@localhost) by xroads.vthrc.uq.edu.au (8.8.6/8.7.3) id IAA00310 for <[email protected]>; Fri, 21 Aug 1998 08:58:30 +1000 (EST)
Received: from arundel.vthrc.uq.edu.au(130.102.4.21) by xroads.vthrc.uq.edu.au via smap (V1.3)
id sma000543; Fri Aug 21 08:00:06 1998
X-Sender: [email protected]
Message-Id: <v02140b01b20248b1a623@[130.102.4.21]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 21 Aug 1998 08:00:07 +1000
To: [email protected]
From: [email protected] (Danny Thomas)
Subject: for a departmental environment? (lotsa Q)
Sender: [email protected]
Precedence: bulk

While a PC has been ordered, I haven't installed NetraMet yet nor even
closely read the docs or RTFM RFCs, so the following will probably display
my ignorance more than anything. I was tempted to cross-post to the rtfm
list because these questions do span both netramet & rtfm in general.

RTFM USEFUL AT DEPARTMENTAL LEVEL?
==================================
My main question is how suitable and practical is RTFM at a departmental
level. Comments?
Are there other management approaches more suited to our situation?

OUR NET
=======
I don't think we really need RTFM so I can't argue committing lots of
$$$/time for it; I'm looking at this more out of general interest and
thinking it's a good thing to do. We're also coming from a low baseline and
aren't currently doing any management: at present we don't any hard numbers
on the net at all - about two years I dragged up a NetBSD PC and ran
tcpdump to see average bandwidth in a one-hour period hovering about 5%.
Hardly the basis for making rational planning decisions on.

Our basic net topology is about 70 macs/pcs/printers spread across four
wings. Each wing has a 10BaseT hub which in turn plugs into a 10/100 switch
connecting to the campus network. A few other devices, notably our main
server also plug into a port on the switch. Network traffic isn't that
busy. There are several ways we could go about it:

ONE METER PER ETHERNET SEGMENT
==============================
One approach is to install a meter in the ethernet segments in each of the
four wings. So my first questions are about such hosts, though it also
applies to any PC-based meter. I ask this question again below, in the
context of a PC with multiple ethernet cards

1) it seems a hard-disk is not required so all we need is a case,
motherboard, CPU, probably 16M RAM, ethernet, a floppy disk, and the
most-basic display card. Right? Oops, nearly forgot the MSDOS licence 8-)

2) While our ethernet isn't that loaded, would a busier one require a fast
CPU or system? I can pick up a decent motherboard (FIC PA-2007) for not
much over $120 from the states, but is it worth considering one of the
faster ones (100MHz system bus)? Is a 200MHz K6 more than sufficient or
would an old 90MHz Pentium chip suffice?

3) I'd run the ntm32p version?
The user guide didn't really say this was an improvement over ntm32 but one
assumes so. I guess it was just a question of setting the compiler for a
Pentium, but does it make much difference in performance?

4) I'd probably go for a PCI card based on the DEC 2xx4x chipset ($70), but
is there a packet driver modified with the "high-performance packet driver"
option available for such cards? Of those listed in the Netramet 4.1 user's
guide, I know the NE2000 in particular has a poor rep on the NetBSD list.
Does it drop packets during peaks? Even if it did would that be significant
from a management perspective?

SINGLE METER MONITORING MULTIPLE SEGMENTS
=========================================
Instead of having a separate meter for each wing's segment, it would be
nice if we could use a single box running four ethernet cards. Trouble is
it's a fibre run back from each wing to the wiring cabinet with a single
patch cable from the fibre transceiver to the switch port. Assuming it's
not running duplex, is there a hack such that the two signal lines between
the switch port and fibre xcvr could be "combined" and fed into the input
line into an ethernet card in the meter? I knew coaxial media had some good
points.

I guess you'd want a decent PC system if it's metering 4 ports,
particularly if all four were running at 100MHz. Again is CPU performance
the issue? I'm not a great believer in over-clocking but would tweaking the
PCI bus be useful, ie above 33MHz. Do some models of ethernet cards place
less load on the bus, ie more efficient DMA?

[in terms of tapping the meter ethernet card into the switch port<->fibre
patch cable, the 350 manual describes port-mirroring whereby a single port
can monitor traffic on one or two other ports. Maybe the limitation of
having only one monitor port might be lifted in a software update? It also
says you need to connect a 'probe' device to the monitoring port, whatever
that is. Of course port-mirroring uses up switch ports, but we could
sacrifice some of the 12]

METER RUNNING IN SWITCH
=======================
I guess the ideal situation would be for the Bay switch to be running as
the meter but I couldn't see RTFM pr RFC2063 mentioned in the manual. In
fact a quick search thru the Bay web-site didn't look too promising at all.
So is there any chance Bay will provide an option to update our 350F with
RTFM so I wouldn't need the PC meters? Are companies like Cisco & Bay
building RTFM into any of their system? Are they pushing alternatives?

To be specific: there's a slight chance we might be able to replace our
350F switch: are there any low-end 10/100 switches around that come with
built-in 2063 RTFM?

MONITORING THE OUTSIDE PORT
===========================
Apart from monitoring the internal traffic flows, the main interest is the
external flows. We're looking at placing a drawbridge packet filter on the
link going to the outside world. The new version of this software runs on
FreeBSD, so would it be feasible to run a meter on this system as well? It
would seem so from rfc2123. At present it's a 10MHz link but we may upgrade
to 100MHz, partly for political reasons.

oh well, can't think of anything else...

thanks for your indulgence,
Danny Thomas