Telescope traces

• Number of extracted flows

  
  Flow = ordered sequence of packets identified only by the source address IP (the address outside the telescope network address set).
  
  
  
  
  • The number of extracted flows depends on the flows timeout, if the timeout is too low, some flows are separated in different parts.
    
  • Computation time: The extraction time of the flows from the traces have a similar dependence on the flow timeout.
    Therefore we will use a timeout of 300 seconds.

• Number of packets for each flow

  • Histogram of the number of packets per flow:
    
  • Histogram of the number of bytes per flow (peak for 96 bytes - couple of empty packets of 48 bytes):