[netsa-tools-discuss] Understanding LOADMETHOD=4

[asad]

Thanks Marks for step by step explanation, can using flows/second I can
fill in the table as needed.

The only thing I'm still confused is for "time-proportional" or
"--load-scheme=4" how are "active flows" calculated,

Like   (bytes/second  )* active flows=

In the example mentioned in the link here
http://tools.netsa.cert.org/silk/rwcount.html

Time proportional columns (first is ) 600

Now
(60 bytes/210 seconds)=60 should I consider active flows as 10 seconds

Thanks.

On Thu, Oct 1, 2015 at 8:08 PM, Mark Thomas <mthomas at cert.org> wrote:

> For a record that spans multiple bins, divide the flow by its
> duration to get values for
>
>   flows/second
>   bytes/second
>   packets/second
>
> The example flow has 3000 bytes and 300 packets across 60 seconds,
> and the values are:
>
>   flows/second   =    1/60
>   bytes/second   =   50
>   packets/second =    5
>
> To find the amount of volume to add to each bin, multiply the
> per-second values by the time spent in the bin.
>
> For the first bin, the number of seconds in the bin is
>
>   bin_end_time - flow_start_time
>
> For the final bin, the number of seconds is
>
>   flow_end_time - bin_start_time
>
> For the middle bin(s), the number of seconds is the bin_size.
>
> I think that example may have been more clear if the flow spent 10
> seconds in the first bin and 20 seconds in the final bin.
>
> There is another example in the rwcount manual page.
> http://tools.netsa.cert.org/silk/rwcount.html
>
> See also the discussion (and picture) in section 3.4.4 of the
> Analyst's Handbook.
> http://tools.netsa.cert.org/silk/analysis-handbook.pdf
>
> -Mark
>
>
> On Thu, 1 Oct 2015 14:56:43 +0500, asad wrote:
>
> > Hello,
> >
> > I'm following the excellent write - up here,
> >
> >
> https://tools.netsa.cert.org/confluence/display/tt/Using+--load-scheme+to+Allocate+Flows+to+Bins+in+rwcount
> >
> > I'm only stuck at last example for LOADMETHOD=4 here is the chart given
> >
> > The first bin 1 in bytes rows is given value of "750", If  Each bin is
> > allocated a percentage of the flow's record, packets and bytes
> > proportional to the amount of the flow's active time that spans the
> > bin what is the backend mathematical formula used? Thanks.
> >
> > regards.
> > Asad
>
-------------- next part --------------
HTML attachment scrubbed and removed