how to decipher cdcc output

David Sparks daves@activestate.com
Tue Jul 6 00:13:18 UTC 2004


Can someone help me decipher cdcc output please?  I'd like to break down 
the following cdcc command -- I've given it my best guess below.


dcc2 dcc # cdcc 'id 1214' 'stats all'
127.0.0.1,6277
         server-ID 1214  client-ID 1214  16:33:38
     version 1.2.48  tracing ANON CLNT
37779453 hash entries 30927061 used 1017394728 DB bytes
     0 ms delay  40507 NOPs  40322 ADMN  1411 query  22 clients in 24 hours
29804790 reports  134614>10     181>100       0>1000       0 many
         answers 17176114>10 15435635>100 13360918>1000 12373683 many
    35 bad IDs   24 passwds   0 error responses     0 retransmitted
     0 answers rate-limited   0 anonymous           0 rejected reports
     flood on   5 streams   4 out active 3 in 137379174 total flooded in
63825763 accepted 844520 stale 72677072 dup      0 white    0 delete
90798618 reports added between May 31 12:19:02.116160 PDT and Jul 05 
16:33:38
----->%-----

I've put my understanding below, and marked anything I'm unsure of as a 
question:

  tracing ANON CLNT

The server reports anonymous and authenticated client errors.  Does this 
mean that all errors will have a corresponding line in syslog?


  0 ms delay  40507 NOPs  40322 ADMN  1411 query  22 clients in 24 hours

The server does not delay unauthenticated answers, 40507 queries were 
not signature related, 40322 of 40507 queries were related to admin 
functions? and 22 unique clients identified by the combination of client 
ID and IP address were seen in the last 24 hours.  What is "1411 query"?


  29804790 reports  134614>10     181>100       0>1000       0 many

The server received 29804790 signature reports, 134614 reports were 
registered as being sent to >10 recipients, and 181 reports were 
registered as being sent to >100 recipients.


  answers 17176114>10 15435635>100 13360918>1000 12373683 many

The server sent 17176114 answers saying it had seen the signature >10 
times, 15435635 answers saying it had seen the signature >100 times, 
etc.  Why do the answers not add up to the reports if all dcc clients 
using reporting client IDs?


  35 bad IDs   24 passwds   0 error responses     0 retransmitted

The server received 35 connection attempts with bad ids, and 24 bad 
passwords with valid ids.  Are those client or server ids and passwords?


  0 answers rate-limited   0 anonymous           0 rejected reports

The server never rate limited answers (-R command line) and didn't 
reject any reports (-Q command line).


  flood on   5 streams   4 out active 3 in 137379174 total flooded in

The server has 5 ids in the /var/dcc/flod file, 4 outgoing floods and 3 
incoming floods are currently active.  137379174 signatures have been 
flooded in since May 31 12:19:02.116160 PDT (date comes from below).


  63825763 accepted 844520 stale 72677072 dup      0 white    0 delete

The server added 63825763 of 137379174 signatures to its database, and 
rejected 844520 signatures as old and 72677072 as duplicates.  No 
signatures matched the server whitelist, and there were no signature 
deletes (cdcc delck command line).


  90798618 reports added between May 31 12:19:02.116160 PDT and Jul 05 
16:33:38

The server increased its database of signatures by 90798618 from direct 
queries to the server (as opposed to the signature flooding mechanism) 
during the time period listed.



TIA!

ds



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.