[aprssig] xastir bug?

[Steve Dimse]

Here is one for all you xastir guys:

A few weeks ago I created a monitor tool to keep an eye on my parser, it counts the number of raw packets processed every minute and then gives me a graph. I saw periodic outbursts that made no sense, so I went hunting. I identified it as thousands of telemetry packets like

YB6HJE-3>APRX28,TCPIP*,qAC,MYAPRS-1:T#987,0.0,0.1,0.0,0.0,0.0,00000000

The count increased with each packet. A flood of these (about 20,000 over five minutes!) would happen, then nothing for 12-24 hours. I tried to get in touch with YB6HJE, I figured it was a bad configuration or something but got no answer from the QRZ address. The blips have occurred with less frequency the last week, but another very large one just happened, this time the packets are

IR0UAQ>APRX28,TCPIP*,qAC,T2LEIPZIG:T#654,0.0,0.0,0.0,0.0,0.0,00000000

This mysql query is the packet count since 1900z, 37 minutes when I ran it:

mysql> select count(*) from raw where `call` = "IR0UAQ" and time_rx > 20140131190000;
+----------+
| count(*) |
+----------+
|    31617 |
+----------+
1 row in set (0.02 sec)

31,617 packets in less than an hour! The total packet count for this same period was

mysql> select count(*) from raw where time_rx > 20140131190000;
+----------+
| count(*) |
+----------+
|   141751 |
+----------+
1 row in set (0.10 sec)

More than 22% of the load was this one station, and that is averaged over 40 minutes, but the burst was only about 5 minutes long.

Two separate guys running APRX28 make me worry there is a subtle bug in the code, and even if it is a misconfiguration it needs to be prevented. If something triggered every xastir to suddenly go off it would bring down the APRS IS!

Steve K4HG