Re: [Flow-tools] Is the timestamp in each flow record CORRECT?

[zhang su]

for example, packets of a flow are aggregated in 1 min record. A flow spans 
to multi-min-records. There is a timestamp for the first packet in this 
record, and another timestamp for the end time of the last packet in this 
record. I thought those record should be correct?
Am I right? or only the last packet of the last record of a flow is correct?

>From: bill fumerola <[EMAIL PROTECTED]>
>To: zhang su <[EMAIL PROTECTED]>
>CC: [EMAIL PROTECTED]
>Subject: Re: [Flow-tools] Is the timestamp in each flow record CORRECT?
>Date: Tue, 2 Nov 2004 11:28:06 -0800
>
>the times in each flow record are when the flow is created/torn down.
>flows are not per-packet (even if the flow only contains one packet).
>
>if you're looking for precise packet statistics, get a sniffer. if 
you're
>looking for aggregated traffic statistics, netflow is it..
>
>--
>- bill fumerola / [EMAIL PROTECTED]
>
>

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/

_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools