results: flow interval spacing - packet interarrival time is _always_ less than 2s - 4s timeout sufficient to capture most application flows