App Byte Ratio question...

Craig Merchant craig.merchant at
Fri Sep 26 16:44:43 EDT 2014

Hey, Carter.


I've been playing around with the app byte ratio in our environment.  I've had some success feeding it to a machine learning application (Prelert).


One thing that occurred to me was if you saw any value in using a weighted version of ABR, such as ABR * total bytes in the flow or ABR * duration of the flow.  I'm wondering if lots of small flows or short flows might distort the average ABR for a given host/protocol/port when compared to a long running or high volume flow.


Just curious what your thoughts are on the matter.  I'm not a quant.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the argus mailing list