zero flow duration?
Michael Hornung
hornung at cac.washington.edu
Thu Oct 11 17:44:20 EDT 2007
I'm trying to look at average bandwidth utilization per host offering
services on a segment I'm monitoring. To do so I'm running the following
on an argus file:
racluster -r file -M norep -w - -- ip | \
ra -s daddr bytes dur -- 'dst net (blah)'
In many of the records there is a byte count but the flow duration reads
"0.000000". Can you explain in what curcumstances a flow has a duration
of 0? My guess is that the given flow did not end within the file I'm
passing through racluster?
-Mike
More information about the argus
mailing list