Network timing evaluation used to detect beacons, works with argus flow as the source