help understand output

[Michael Hornung]

Hi, I'm trying to absorb some argus results I'm seeing and I would love 
any feedback you care to offer.  I'm trying to generate network 
performance stats for the roughly 5 minute window encompassed by a given 
argus file.

The filename is 1173830402 and indicates the timestamp when the argus file 
was archived.  The pipeline I've chosen is:

racluster -M rmon -r 1173830402 -w - |   \
rasort -r - -w - -m pkts - 'src net X.Y.0.0/16 or src net X.Y.0.0/16' |  \
ra -r - -s saddr stime dur srate drate pkts sloss dloss sjit djit tcprtt -

What I'm attempting to do with the above is aggregate the flows from the 
one file using 'racluster', then use 'rasort' to sort the output stream by 
number of total flow packets and limit results to flows with source IP on 
the networks I'm examining, then lastly to use 'ra' to print the values I 
think are interesting.  First off, is what I've done a reasonable way to 
get these deetails for every flow in the file?

Here are the first few lines of output, and I have some questions below 
that:

      X.Y.41.50    15:55:35.565814 265.849501   107619.148  4909709.500 
166922          0        717     9657.000     7612.128     0.000000

      X.Y.59.54    15:55:35.528842 266.161310  2766199.500    81832.180 
105633        816         64    15169.226    17774.765     0.000000

     X.Y.39.244    15:55:35.562186 264.461433    66525.547  2836946.000 
104869          0        386    38966.000    28543.830     0.000000

      X.Y.40.15    15:55:35.529837 266.712496    77486.641  2527835.250 
94988          1       1107    26946.000    19721.859     0.000000

      X.Y.117.8    15:55:35.590168 181.982163    76109.609  3445644.000 
80115          0        342    37715.000    28914.062     0.000000

      X.Y.26.112    15:55:35.593296 262.440843  1409295.625   103432.859 
70112         38        189    79309.000    46967.357     0.000000

      X.Y.40.91    15:55:35.597797 265.680459    52282.656  1952823.500 
68964          0        300    16701.000    15050.079     0.000000

       X.Y.61.3    15:55:35.558065 266.818069    44189.512  1537505.000 
60578          0        310    32309.000    24219.612     0.000000

     X.Y.45.125    15:55:35.569448 266.890136    41935.457  1511283.125 
58026          0        258    26755.000    22366.359     0.000000

     X.Y.38.232    15:55:35.574330 265.466687   289928.406   538903.688 
55949          0          0    13978.000    12320.000

    X.Y.115.165    15:55:35.531332 265.404640  1517963.000    35730.168 
54641         70         27    18501.262    22818.404     0.000000

     X.Y.115.57    15:55:35.396544 266.015024  1459115.750    45962.309 
54044        231          2    21290.250    24470.000     0.000000

Questions:

How can the source packet rate (column 4) and destination packet rate 
(column 5) be higher than the total number of packets for the given flow 
(column 6)?

Why does the third record from the bottom have nothing in the tcprtt 
(last) column?

Can I safely assume that the tcprtt for all the other records here is 
0.000000 because the TCP sessions were not *established* during the window 
I'm reporting on?

What are the units for the sjit and djit (jitter) fields?  They look too 
big to be milliseconds.

Are sjit and djit reporting the average for a given flow, or how is the 
jitter being characterized?

Thanks so much to those that can offer info.

-Mike