<br><font size=2><tt>Hi Adrian,</tt></font>
<br>
<br><font size=2><tt>I really haven't dealt with that portion of the Summary
report before. I have included the flow time section from a summary report
of one of my routers below.</tt></font>
<br>
<br><font size=2><tt>Flow time distribution:</tt></font>
<br><font size=2><tt> 10 50 100 200
500 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000</tt></font>
<br><font size=2><tt> .121 .009 .106 .149 .226 .195 .071 .037
.020 .013 .011 .008 .005 .004 .003 </tt></font>
<br>
<br><font size=2><tt> 12000 14000 16000 18000 20000 22000 24000 26000
28000 30000 >30000</tt></font>
<br><font size=2><tt> .004 .002 .001 .000
.000 .001 .000 .000 .000 .000 .014
</tt></font>
<br>
<br><font size=2><tt>As you can see most of mine (about 92%) are below
3 seconds (if that's the correct interpretation - but it makes sense to
me.)</tt></font>
<br>
<br><font size=2><tt>Now, if 73% of your flows are more than 30 secs, I
would take a look at your netflow configuration. Or you may have a lot
of long flows (FTPs, etc.)</tt></font>
<br>
<br><font size=2><tt>Since FlowViewer simply relays the output of flow-tools,
I've taken the liberty of posting this to the flow-tools mailing list where
maybe someone can confirm it for you.</tt></font>
<br>
<br><font size=2><tt>Joe</tt></font>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>"Huber Adrian
TRAIL" <Adrian.Huber@teckcominco.com></b> </font>
<p><font size=1 face="sans-serif">08/06/2008 03:38 PM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">Joe Loiacono/CIV/CSC@CSC</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Question regarding FlowViewer</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=2 face="Arial">Hello!</font>
<br><font size=2 face="Arial">
I’ve been spending some part of my morning trying to figure this one out,
but I have not much success…</font>
<br><font size=2 face="Arial">I’m trying to figure out how to interpret
the ‘Flow Times Distribution” field in the FlowViewer Summary report.
I understand that Cisco uses this format, where the top number indicates
the range, and the value below it indicates the percentage of packets (or
octets) of that sample fall into that range…</font>
<br><font size=2 face="Arial"> </font>
<br><font size=2 face="Arial">Ie: </font>
<br><font size=2 face="Courier New">Flow time distribution:</font>
<br><font size=2 face="Courier New"> 10 50 100
200 500 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000</font>
<br><font size=2 face="Courier New"> .120 .000 .000 .016 .002
.000 .022 .004 .024 .004 .000 .006 .000 .004 .010 </font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> 12000 14000 16000 18000 20000
22000 24000 26000 28000 30000 >30000</font>
<br><font size=2 face="Courier New"> .012 .030 .002
.000 .000 .000 .000 .002 .004 .000
.737 </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"><b>Now what I’m trying to figure
out is what do these ranges indicate??? Are we talking milliseconds, seconds,
etc????</b></font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">I’m assuming that %73.7 of my
traffic had flow times in excess of 30 seconds… Are my interpretations
correct?</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">Thanks in advance.</font>
<br><font size=2 face="Arial"> </font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">Thank you,
</font>
<br><font size=2 color=#008000 face="Arial"> </font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">Adrian G. Huber,
CCNA, N+, ATHC</font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">Network Analyst</font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">(250) 364 4805</font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">Teck Cominco
Metals Ltd.</font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">25 Aldridge
Ave</font>
<br><font size=2 color=#008000 face="Arial Rounded MT Bold">Trail, BC V1R
3T8</font>
<br><font size=3 face="Times New Roman"> </font>
<br>