Under what circumstances will an ICMP flow with state ECO return dbytes of 0?

[Matt Brown]

Hello again,

I am investigating how to use argus for "node liveliness detection."

Considering leveraging ra() as:

ra -S 127.0.0.1:561 -s ltime stime daddr sport sbytes dbytes flgs state - icmp

I see dbytes can be 0 when the state of a flow is ECO.

Why would this be?


I have covered this question thoroughly on the network engineering
stackexchange: http://networkengineering.stackexchange.com/q/5683


I think this is my last question for the day!


Thanks,

Matt



Any assistance is appreciated.


Thanks,

Matt