ABRatio question

[Craig Merchant]

Carter,

I've been playing around a bit with the ABRatio field.  In trying to figure out the best way to identify if a host is a consumer or producer across all flows.  If a host has a single high-volume flow where it is a producer and a bunch of small flows where it is a consumer, averaging the ABRatio would seem to skew the results towards it being a consumer.

Would it be more accurate to multiply the ABRatio by either the volume of bytes in the flow or the duration of the flow prior to averaging a host's ABRatio?  And if so, do you think it's better to look at that ratio over the volume of data or over time?

Thx.

C
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130606/8ee129df/attachment.html>