IETF Logo Mail Archive

Re: Comparing an old flow snapshot with some packet size data

"Michael A. Patton" <MAP@bbn.com> Tue, 06 August 1996 18:11 UTC

Received: from ietf.org by ietf.org id aa17751; 6 Aug 96 14:11 EDT
Received: from cnri by ietf.org id aa17747; 6 Aug 96 14:11 EDT
Received: from murtoa.cs.mu.OZ.AU by CNRI.Reston.VA.US id aa11890; 6 Aug 96 14:11 EDT
Received: from mailing-list by murtoa.cs.mu.OZ.AU (8.6.9/1.0) id DAA10558; Wed, 7 Aug 1996 03:57:41 +1000
Received: from munnari.OZ.AU by murtoa.cs.mu.OZ.AU (8.6.9/1.0) with SMTP id DAA10529; Wed, 7 Aug 1996 03:53:18 +1000
Received: from BBN.COM by munnari.OZ.AU with SMTP (5.83--+1.3.1+0.56) id RA06951; Wed, 7 Aug 1996 03:53:08 +1000 (from MAP=Bounce@BBN.COM)
Received: by BBN.COM id ae09946; 6 Aug 96 13:47 EDT
Received: from BART.BBN.COM by BBN.COM id aa09585; 6 Aug 96 13:37 EDT
Date: Tue, 06 Aug 1996 13:36:55 -0400
Message-Id: <mpatton=1996Aug06133655@bart.bbn.com>
To: kwe@6sigmanets.com
Cc: big-internet@munnari.oz.au
In-Reply-To: <2.2.32.19960806000836.00d194b8@mail.cts.com> (kwe@6sigmanets.com)
Subject: Re: Comparing an old flow snapshot with some packet size data
Sender: ietf-archive-request@ietf.org
From: "Michael A. Patton" <MAP@bbn.com>
Reply-To: "Michael A. Patton, Big-Internet mail" <MAP=Big-Internet@bbn.com>
Precedence: bulk

   Date: Mon, 05 Aug 1996 17:08:36 -0700
   From: "Kent W. England" <kwe@6sigmanets.com>

   ... I don't understand the 78 bytes/pkt for FTP, [in Sean's sample]

Note that this is on the FTP control port.  The actual data is on
other ports and can't easily be recognized... I'm not sure how to
interpret that as it's less than I would expect (the FTP control
connection should have both IP and TCP overhead on every packet, and I
would expect more than half the packets to have either an FTP command
or response in them, this makes 78 seem too small to me on first thought).

   but the WWW bytes/pkt of 247 is roughly consistent with the packet
   distribution of 30% at 40 bytes and 22% at 552. If I average 40 and 552 I
   get 296, near to 247. It's rough, but sensible.

Or to do a pro-rated average (probably a little better, although still
only an estimate): (30*40+22*552)/(30+22) => 256 (even closer to 247
and an interesting number in it's own right :-).

	-MAP

v2.23.0 | Report a Bug | By Email