Re: [Flow-tools] Is the timestamp in each flow record CORRECT?

[zhang su]

Hi,

 Thank you very much for your kind reply. I still have one question to clear up my confusion.

I still think the last packet you refered is the last packet of the flow. But a flow have multiple records, there are ending timestamps for each record including the one in the last record which could be wrong due to the flow expiration. So the last timestamp in the last record of the flow may not be accurate, but I am wondering whether the ending timestamp in the middle records for the same flow is accurate.

 Also I do not think I can calculate the Avg RTT since packets are send in bunch (<sender window size), and what I calculated is just the Avg Inter packet time which is smaller than Avg RTT. One way to estimate (not accurate) RTT is that I can assume the slow start, so for 64 packets sent, there may be 1+2+4+8+16+32=63, about 7 rounds to send out 64 packets, so (endtime-starttime)/# of rounds, may be an estimate, but really not accurate due to the congestion control.

but anyway, my question is still whether the end timestamp in the middle records of a flow are accurate in stead of the very last end timestamp in the very last record.

 

thanks you! have a good weekend!

 

>From: bill fumerola <[EMAIL PROTECTED]>

>To: zhang su <[EMAIL PROTECTED]>

>CC: [EMAIL PROTECTED]

>Subject: Re: [Flow-tools] Is the timestamp in each flow record CORRECT?

>Date: Thu, 4 Nov 2004 11:52:48 -0800

>

>On Thu, Nov 04, 2004 at 06:21:22PM +0000, zhang su wrote:

> > for example, packets of a flow are aggregated in 1 min record. A flow spans

> > to multi-min-records. There is a timestamp for the first packet in this

> > record, and another timestamp for the end time of the last packet in this

> > record. I thought those record should be correct?

> > Am I right? or only the last packet of the last record of a flow is correct?

>

>the end time doesn't have to be the exact time the last packet was seen.

>it could be when the flow expired. the data could be sampled. this is

>all implementation dependent.

>

>is this the calculation you're trying to make?

>

>(endtime - begintime)

>--------------------- = average RTT

>         #pkts

>

>if so, that's never going to work consistantly. beyond what i said above,

>multiple conversations could have occured (overlapping or sequentially)

>in the same aggregated flow, depending on flow granularity.

>

>--

>- bill fumerola / [EMAIL PROTECTED]

>

>

---

Express yourself instantly with MSN Messenger! MSN Messenger Download today it's FREE!

_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools