Re^3: analyzing data

[matt00perl]

they are not sorted by time, all i want is to show how long one src_ip spent on particular dest_ip

[Theodore]

You can't know that. You can know how much time passed between the first and the last packet from a specific src_ip to a specific dst_ip for a specific arbitrary time span or a specific log file.

Example: You may have one day's worth of data. There is a packet going from ip A to ip B at 00:01. There is a second packet between A and B at 23:59. Is this (23 hours 58 mins) "how long" ip A spent on ip B?