Breaking down selected traffic

Steve McInerney spm at
Thu May 8 21:11:35 EDT 2003


good question.
consolidated together wouldn't be a bad option, but perhaps it might be 
better to use the port column to show the icmp type?

ie .... icmp echo ...
	icmp unreachable ...
or similar

And yes, from the data set it was both ECO's and URP's, hence the two 
different icmp lines. Thanks for the insight!

- Steve

Carter Bullard wrote:
> Hey Steve,
>    They are different ICMP types, echo, unreachable, etc...
> They probably should be consolidated together, or are they
> different ICMP services?
> Carter
>>-----Original Message-----
>>From: Steve McInerney [mailto:spm at] 
>>Sent: Thursday, May 08, 2003 7:25 PM
>>To: Carter Bullard
>>Cc: argus-info at
>>Subject: Re: Breaking down selected traffic
>>Thanks Carter!
>>What about the duplicate ICMP's?
>>No real biggie, more of a minor concern.
>> From what I can see, they're approaching a magic 64K 
>>boundry, outbound. 
>>Is that the reason for the roll over there?

More information about the argus mailing list