![](https://assets.cambridge.org/97805218/80695/cover/9780521880695.jpg)
Book contents
- Frontmatter
- Contents
- Acknowledgments
- 1 Introduction
- 2 Background and context
- I Network monitoring and management
- II Network design and traffic engineering
- III From bits to services
- Appendix A How to link original and measured flow characteristics when packet sampling is used: bytes, packets and flows
- Appendix B Application-specific payload bit strings
- Appendix C BLINC implementation details
- Appendix D Validation of direction-conforming rule
- References
- Index
Appendix A - How to link original and measured flow characteristics when packet sampling is used: bytes, packets and flows
Published online by Cambridge University Press: 05 September 2012
- Frontmatter
- Contents
- Acknowledgments
- 1 Introduction
- 2 Background and context
- I Network monitoring and management
- II Network design and traffic engineering
- III From bits to services
- Appendix A How to link original and measured flow characteristics when packet sampling is used: bytes, packets and flows
- Appendix B Application-specific payload bit strings
- Appendix C BLINC implementation details
- Appendix D Validation of direction-conforming rule
- References
- Index
Summary
In order to compile flow statistics, each router maintains a table of records indexed by flow key, e.g. 5-tuple of the flow. A flow is said to be active at a given time if there exists a record for its key. When a packet arrives at the router, the router determines if a flow is active for that key. If not, it instantiates a new record for that key. The statistics for the flow are updated for the packet, typically including counters for packets and bytes and arrival times of the first and most recent packet of the flow. Due to the fact that the router does not have knowledge of application-level flow structure, it must terminate the flow according to some criteria. The most commonly used criteria are the following: (i) inter-packet timeout, e.g. the time since the last packet observed for the flow exceeds some threshold; (ii) protocol syntax, e.g. observation of a FIN or RST packet of the TCP flow; (iii) aging, e.g. flows are terminated after a given elapsed time since the arrival of the first packet of the flow; (iv) memory management, e.g. flows might be terminated at any point in time to release memory. When a flow is terminated, its statistics are flushed for export and the associated memory is released for use by new flows.
- Type
- Chapter
- Information
- Design, Measurement and Management of Large-Scale IP NetworksBridging the Gap Between Theory and Practice, pp. 367 - 370Publisher: Cambridge University PressPrint publication year: 2008