On Mar 8, 2011, at 3:30 AM, Vern Paxson wrote:
> I'm confused. Are you referring to [or]{lower,upper}? I'm not recalling
> [or]size ...
[or]size is in the endpoint record. I think you may be thinking of the large-conns.bro script that calculates an upper and lower bound for the connection size.
.Seth