1 is extracted from the syn or syn ack packet s 600 then sequence number s 2 is extracted from the fin rst packet s 601 finally the flow length is calculated to be s 2 s 1 modulo 2 32 s 602 following computation of the flow lengths the correlation engine 106 computes the flow duration time i e the time between the syn and the fin flag packets s 506 the correlation engine 106 then determines if the payload for the selected packet is greater than zero s 507 if the payload is zero the process exits s 501 if the payload is not zero the correlation engine determines the payload checksum in the manner described in connection with fig4 s 508 the process then exits s 501 once a packet has been selected that packet must be correlated with the same packet on the other side of the nat 103 the process of correlation will be described with reference to fig7 which is a flow chart showing the correlation process the first step of the process is to determine a time that the selected packet passes through the tap 107 a and hence a time window that the.