How joy merging UDP packets in a flow about joy

[bhudson33]

you could play with the default values defined in p2f.c and maybe get some values that will produce whatever it is you are looking for. Look around line 290 and you will see the definitions for the inactive and active timeouts.

[davidmcgrew]

You could also try out the ./joyq --stitch option David From: bhudson33 <[email protected]<mailto:[email protected]>> Reply-To: cisco/joy <[email protected]<mailto:[email protected]>> Date: Monday, July 31, 2017 at 9:45 AM To: cisco/joy <[email protected]<mailto:[email protected]>> Cc: Subscribed <[email protected]<mailto:[email protected]>> Subject: Re: [cisco/joy] How joy merging UDP packets in a flow (#68) you could play with the default values defined in p2f.c and maybe get some values that will produce whatever it is you are looking for. Look around line 290 and you will see the definitions for the inactive and active timeouts. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#68 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AD0LLxvj-AnFB_g-8fHeP9hYVtmxCevKks5sTdp4gaJpZM4OiAwR>.

[bhudson33]

what were the command line parameters you used to invoke joy?

[arunmir]

joy tls=1 dns=1 ip_id=1 dist=1 http=1 num_pkts=1 output="./Output.gz" ./161101Amazon.pcap.pcapng

I have attached the pcap file I used below. It has 76 packets totally. But joy generating only 40 records

161101Amazon.pcap.pcapng.zip

[bhudson33]

We believe this to be the intended behavior. In your PCAP, there are ~9 unique 5-tuples. In a perfect world you would only see ~9 Joy flow records. However, due to the inactive timeout, new flows get created with the same 5-tuple. This means that the number of flows should vary somewhere between 9 and total packets of 76 based on the inactive timeout. What we see based on the PCAP is 40 Joy flows which seems about right when taking the inactive timeout into account. Hopefully, this explains what you are seeing.

[arunmir]

Ok, I got it. Thank you very much.
I wonder, is there any way to change/disable the the inactive timeout period in JOY?