From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 576733B29E for ; Mon, 30 Jul 2018 14:11:24 -0400 (EDT) Received: by mail-qk0-x22a.google.com with SMTP id b5-v6so8447024qkg.6 for ; Mon, 30 Jul 2018 11:11:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=q+AJOYoBN1yP8oQI3uWONBHalWzgL+1gYLQ0oXR+VR0=; b=WMj2KQAwgYNNu81OhzZuosiBSDheLUgEHC3255vA3al5llvtKMI0sDsKrJkSTnNlNj q1cLuPh1CdtPEjUwWLz+EtB16pefemoLVz+W5+GWPUbPNrNcJT+r0gOYZH+W0bln3/Tr Xok0nAm3asm5acS+SzfX7mGwSVNlENTB9p8dnuJan2aQvltAvrNSb/ij1+6lexQZKyx7 xw+Twtbe0CzrKETwnSu2oBuK2+JIRAuTbAGoGxA3ymLtBEUM1CCUeMj5V/8+5aJ/QWgy OblvlLCEsTlukDsP02IXOmrdftfzw6ORd3nZDz3tOGS0nUNShEJ5u4vyDrG/ZnkcvDGX QvvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=q+AJOYoBN1yP8oQI3uWONBHalWzgL+1gYLQ0oXR+VR0=; b=ZQhuvRevJqItp0ymcdV0DXIuPg84/DdMr+rQXAwvTm+6NEZiD03uT6DOxXrdfEJSod karnsgnIFGewA8tvucW89BepzeTxa/Tut446ii0YtLjG1MuNWhjY9wJopgIDrxL2/OTA GNsMNuz4XLWawr1U0Z6ouVnHXXdl7/uX+tAV/uZAMtIi6ajSH4Cu5eNQf8GIvXnS4xKx ilasoFwoq8U2lCVOYzdj7vjYjzVkUa2cA8bm0ryfyyrXVEfFA0MjreiBEpj9MC6SfONP jyu5Oxk4yxczJ0LWpyFmWCXwDAsRFqDsh6H1eJA9Ewkh+WeT6y9Gd8LB0V+vQYNZcYEo b0Bw== X-Gm-Message-State: AOUpUlF3If6Gch92+neX0MOBl/SL5Nd8u4aFvGrJY5vU4QePUDXNTfSa 7yvgAGUhHoVFkXLTz/0Gu/I1BKn1pflXB6GBlo7koSEv X-Google-Smtp-Source: AAOMgpcLGPxAY40dGP//2CVjwp1laA7ck51OAf1ENOPuPQNv8UbL/6Yuvk9o2gTDp/DOix117eSYkYvzYezUUGN0GNw= X-Received: by 2002:a37:21e6:: with SMTP id f99-v6mr16058469qki.206.1532974283585; Mon, 30 Jul 2018 11:11:23 -0700 (PDT) MIME-Version: 1.0 From: Dave Taht Date: Mon, 30 Jul 2018 11:11:12 -0700 Message-ID: To: bloat Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: [Bloat] measuring "flows-in-progress" over an interval X-BeenThere: bloat@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: General list for discussing Bufferbloat List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jul 2018 18:11:24 -0000 Of mice, elephants, ants, and lemmings.... I frequently take packet captures to look at actual traffic on my production network, then look at them in wireshark or take them apart via tcptrace. eyeball gives one measurement. Tcptrace gives me a measurement of how many tcp flows were present over that interval, and completed, but not udp. We can't easily measure udp quic traffic for "completion", but we can look at peaks and valleys and the actual presence of that "flow". DNS, and a zillion other sorts of transactions (even arp), to me, count as one or two packet flows. Is there a tool out there that can pull out active flows of all sorts from a cap? somewhat relevant paper: https://dl.acm.org/citation.cfm?id=3D987190 There was a classic one (early 90s) on self similar behavior that I cannot remember just now. Used to cite it.... --=20 Dave T=C3=A4ht CEO, TekLibre, LLC http://www.teklibre.com Tel: 1-669-226-2619