We have a Logrhythm freemium network monitoring solution depending on port mirroring using span ports on switches to receive all traffic and analyze it. But I cannot understand the output.
If I am monitoring, for example, user A usage of YouTube, user A opens YouTube for 30 minutes, When I filter on user A and application YouTube I see around 20 flows each with duration less than 5 minutes, so I cannot figure from the output the total number of minutes spent on YouTube.
I need to know the definition for flow and why 20 flows appear for only one session. Also, for each flow I see a flag which indicates the flow completed or not, so I see 10 flows completed and others not completed. What is the meaning of flow completed or not ?