Processing of flow data with zero duration

Flow data with zero duration might appear in many environments, especially when the sampling is used on the flow source. This article describes the limitations and impact of zero duration in flow data on the analysis. 

Product: Flowmon Collector

Version: Any

Platform: Any

Are the flow data with zero duration excluded from the analysis?

Flow data with zero duration are properly displayed in the traffic graphs and are taken into account in the advanced analysis (top statistics and list of flows).

BPS and PPS values for graph data are computed as follows:

Bytes (octets) and packets are summed for the whole time interval of one column (5 minutes by default) and divided by column duration (eg. 5 minutes). The duration of a single flow does not play any role here.

BPS and PPS values for TOP statistic are computed as follows:

For all rows containing more than one flow record, the duration is computed as the
"highest end time" - "the lowest start time"
For every row, all bytes and packets are summed and divided by the duration computed. The duration of a single flow does not play any role here.

The only limitation for the zero-duration flows is in the "list of flows" where a single flow with zero duration will miss bps/pps values as it is not possible to divide bytes/packets by zero duration.