How long does a flow needs to stay inactive before any resumption in activity is reported as a new flow

Huy N. Hang hangh at cs.ucr.edu
Tue May 10 13:52:18 EDT 2011


Hello there,

I just started using Argus yesterday, and I am very happy with how easy 
it is to use Argus.

I only have one question about the flow aggregation within Argus, and 
I've read the manuals without being certain of what I found. And the 
question is how long a flow needs to stay inactive before it is 
concluded as finished and any resumption is considered as a new flow?

Does Argus use such a metric at all in its packet-to-flow aggregation?

Thanks!





More information about the argus mailing list