Re: [Simple-evcorr-users] counting your losses

2011-11-10 Thread Justin J. Novack
The file attached is for DNS, not DHCP. Events are timed when they come in to SEC, not when they come in to the log file. If you spawn a dump of the log file which contains 1 entry per hour for 24 hours; SEC will see 24 events come in immediately. It cannot parse the log file for the time the

Re: [Simple-evcorr-users] counting your losses

2011-11-10 Thread Tim Peiffer
On 11/10/11 9:54 AM, Justin J. Novack wrote: The file attached is for DNS, not DHCP. Events are timed when they come in to SEC, not when they come in to the log file. If you spawn a dump of the log file which contains 1 entry per hour for 24 hours; SEC will see 24 events come in

[Simple-evcorr-users] counting your losses

2011-11-09 Thread Tim Peiffer
I am trying to instrument sections on our network where various protocol chat dialog is missing. In the atttached example case, I am looking at DHCP, and the transition between the broadcast discovery and the actual leasing. That is to say, the client did hear an OFFER and emit a REQUEST. I