Breaking down selected traffic

[Steve McInerney]

Carter,

good question.
consolidated together wouldn't be a bad option, but perhaps it might be 
better to use the port column to show the icmp type?

ie .... icmp echo ...
	icmp unreachable ...
or similar


And yes, from the data set it was both ECO's and URP's, hence the two 
different icmp lines. Thanks for the insight!


- Steve

Carter Bullard wrote:
> Hey Steve,
>    They are different ICMP types, echo, unreachable, etc...
> They probably should be consolidated together, or are they
> different ICMP services?
> 
> Carter
> 
> 
> 
>>-----Original Message-----
>>From: Steve McInerney [mailto:spm at healthinsite.gov.au] 
>>Sent: Thursday, May 08, 2003 7:25 PM
>>To: Carter Bullard
>>Cc: argus-info at lists.andrew.cmu.edu
>>Subject: Re: Breaking down selected traffic
>>
>>
>>Thanks Carter!
>>
>>What about the duplicate ICMP's?
>>No real biggie, more of a minor concern.
>> From what I can see, they're approaching a magic 64K 
>>boundry, outbound. 
>>Is that the reason for the roll over there?