Passive Measurements
	• first N bytes capture can lose TCP options, other important session information • address encoding (NLANR or normal tcpdpriv) prevents comparison between sites or traces • hostname, geographic and routing mapping of addresses changes over time. currently only partial information about routing archived independently. • clock drift on single card • clock synchronization between multiple cards in single box or between remote boxes
					21