On Thu, Nov 04, 2004 at 06:21:22PM +0000, zhang su wrote:
> for example, packets of a flow are aggregated in 1 min record. A flow spans
> to multi-min-records. There is a timestamp for the first packet in this
> record, and another timestamp for the end time of the last packet in this
> record. I thought those record should be correct?
> Am I right? or only the last packet of the last record of a flow is correct?
the end time doesn't have to be the exact time the last packet was seen.
it could be when the flow expired. the data could be sampled. this is
all implementation dependent.
is this the calculation you're trying to make?
(endtime - begintime)
--------------------- = average RTT
#pkts
if so, that's never going to work consistantly. beyond what i said above,
multiple conversations could have occured (overlapping or sequentially)
in the same aggregated flow, depending on flow granularity.
--
- bill fumerola / [EMAIL PROTECTED]
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
