Message-Id: <200301291424.JAA25866@lawyers.ir.bbn.com> From: Mark Allman <mallman@grc.nasa.gov> Subject: Re: tcptrace Connections set to INACTIve after 4 minutes idle time. Date: Wed, 29 Jan 2003 09:24:06 -0500
Ramani-
> This is what I feel. In capture file mode, we want to timeout
> connections to free up the memory space. And 4 minutes is a good
> heuristic for all types of traffic.
I disagree. This has bit me a couple of times... Two examples that
jump to mind:
* interactive (telnet or ssh) traffic -- long connections and not
necessarily constantly being used
* syn/fin/rst traces are useful for lots of things and they are
necessariy "hole-y"; I know I have had connections with length
greater than the timeout (thus tcptrace considers the syns in
one connection and the fins in another)
My high order bit is that it should be tweak-able in all cases.
(Besides, what's One More Option?)
allman
----------------------------------------------------------------------------
To unsubscribe, send a message with body containing "unsubscribe tcptrace" to
majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 01/29/03 EST