[netsa-tools-discuss] Understanding LOADMETHOD=4

[Mark Thomas]

For a record that spans multiple bins, divide the flow by its
duration to get values for

  flows/second
  bytes/second
  packets/second

The example flow has 3000 bytes and 300 packets across 60 seconds,
and the values are:

  flows/second   =    1/60
  bytes/second   =   50
  packets/second =    5

To find the amount of volume to add to each bin, multiply the
per-second values by the time spent in the bin.

For the first bin, the number of seconds in the bin is

  bin_end_time - flow_start_time

For the final bin, the number of seconds is

  flow_end_time - bin_start_time

For the middle bin(s), the number of seconds is the bin_size.

I think that example may have been more clear if the flow spent 10
seconds in the first bin and 20 seconds in the final bin.

There is another example in the rwcount manual page.
http://tools.netsa.cert.org/silk/rwcount.html

See also the discussion (and picture) in section 3.4.4 of the
Analyst's Handbook.
http://tools.netsa.cert.org/silk/analysis-handbook.pdf

-Mark


On Thu, 1 Oct 2015 14:56:43 +0500, asad wrote:

> Hello,
>
> I'm following the excellent write - up here,
>
> https://tools.netsa.cert.org/confluence/display/tt/Using+--load-scheme+to+Allocate+Flows+to+Bins+in+rwcount
>
> I'm only stuck at last example for LOADMETHOD=4 here is the chart given
>
> The first bin 1 in bytes rows is given value of "750", If  Each bin is
> allocated a percentage of the flow's record, packets and bytes
> proportional to the amount of the flow's active time that spans the
> bin what is the backend mathematical formula used? Thanks.
>
> regards.
> Asad