Peter,
thank you.
I guess then I'll classify these as "spurious" flows and move on.
I do not mean to be a pest about it but is there a time frame for the new
release
that would include the MAC address field?
Very much appreciated,
Alban
On Thu, May 22, 2008 at 8:11 AM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
>
> Alban Dani wrote:
> | I was looking at some nfsen data and sorted it by dstas/bps and got a
> bunch
> | of entries like this one:
> |
> | Date first seen Duration Proto Dst AS Flows
> | Packets Bytes pps bps bpp
> | 2008-05-21 08:13:15.006 0.001 any 23809 2
> | 8000 5.6 M 7.6 M 3.7 G 733
> |
> | How does this correlate?
> |
> | 2 flows with a duration of 0.001 sec and 3.7G of bps?
> |
> | What am I missing?
> |
>
> bps is number of bytes/duration. As duration is pretty small ( 0.001 )
> accuracy is not pretty good as resolution is only
> ms you end up with numbers like these.
>
> - Peter
> |
> | Thanks you,
> |
> | Alban
> |
> |
> |
> | ------------------------------------------------------------------------
> |
> | -------------------------------------------------------------------------
> | This SF.net email is sponsored by: Microsoft
> | Defy all challenges. Microsoft(R) Visual Studio 2008.
> | http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> |
> |
> | ------------------------------------------------------------------------
> |
> | _______________________________________________
> | Nfsen-discuss mailing list
> | [email protected]
> | https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
>
> iQCVAwUBSDVi+P5AbZRALNr/AQJs4AP/Z79qJb5MLv/JtI4tA1/gs4pgOLU9S4fk
> WBAI09nalYIO6OCv2LvdhxxcQwb9qsl2gngxIXKroiS4UzU3cU/caIKOaTTohpkR
> ONbY7zs2WBxlZz4GYDmu/YXbj5DgKOVaqOCbvgqEXu+RQcdKs03Z/54lGDN1/e7T
> muLxfFv8LXI=
> =Oh/5
> -----END PGP SIGNATURE-----
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
