A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented total throughput and address space in use. The team lead asks the analyst to add a metric that captures how long connections typically remain open between internal hosts and external services, so that unusually persistent connections (such as those from a covert channel) can be flagged. Which network profiling element should the analyst measure to satisfy this request?