how to decipher cdcc output

Vernon Schryver
Tue Jul 6 01:24:09 UTC 2004

> From: David Sparks 

> The server reports anonymous and authenticated client errors.  Does this 
> mean that all errors will have a corresponding line in syslog?

close enough

>   0 ms delay  40507 NOPs  40322 ADMN  1411 query  22 clients in 24 hours
> The server does not delay unauthenticated answers,

no, the current average delay from when DCC responses are added to
the queue until responses are sent is 0 ms.

>                                                    40507 queries were 
> not signature related,

no, 40507 DCC NOPs were received.  DCC clients send NOPs to DCC
servers to measure how quickly they are likely to answer real requests.
`cdcc rtt` forces that process.

>                        40322 of 40507 queries were related to admin 
> functions? 

40322 admin functions such as `cdcc stats`

>            and 22 unique clients identified by the combination of client 
> ID and IP address were seen in the last 24 hours.  What is "1411 query"?

1411 requests were pure questions instead of combined reports and questions.
`dccproc -Q` sends queries.
Retransmissions to a DCC server other than server targeted by a report
are also converted to queries.

> etc.  Why do the answers not add up to the reports if all dcc clients 
> using reporting client IDs?

What might client-IDs have to do with anything?
What should add up?  20 reports of a message's checksums,
none for more than 10 targets, should result in 9 answers>10.

10 reports of a message each for a single target after the server
has received a flood report that they message has been sent to
200 targets will result in 10 answers >100.

> The server received 35 connection attempts with bad ids, and 24 bad 
> passwords with valid ids.  Are those client or server ids and passwords?

Both, because DCC clients can use either a client or server-ID, provided
they have the matching password.

> The server increased its database of signatures by 90798618 from direct 
> queries to the server (as opposed to the signature flooding mechanism) 
> during the time period listed.

Flooding checksums are also counted.

Most of this might be clear from tests on an isolated server (no flooding). 
The tests could be `cdcc stats` interleaved with `dccproc` and `dccproc -Q`.

Vernon Schryver

More information about the DCC mailing list

Contact by mail or use the form.