[Bro] using Bro as traffic analyzer.

Readon Shaw xydarcher at 163.com
Mon Dec 5 03:03:13 PST 2011

>>  At the same time, roughly packet loss rate (vs different timescales)
>> should be calculated
>> by tcp retransmission rate.
>Are you interested in the packet loss rate for the three-way handshake
>only, or for all retransmissions in each connection?
all retransmissions should be collected.
>What level of detail are you looking for? (IE. Just that the segment was
>retransmitted or perhaps more specific data about how it was retransmitted
>such as in response to a retransmission timeout or other recovery method?)
it would be better that retrans mode were detected.
>*- *James Swaro*

Readon Shaw

More information about the Bro mailing list