Re: [IPFIX] Export of long lived flow information

[Paul Aitken <[e-mail]>]

Andrew,

> A flow is defined as a set of packets which all have some common 
> properties, and the original idea of a flow was based on the common 
> 5-tuple of IP address, IP protocol and ports.  A Flow Record is formed 
> from any observation of packets belonging to a Flow (not all packets 
> within the flow are necessarily observed).
>
> If my PC opens an HTTP connection to some server and downloads a 
> simple web page, then we'd expect to see one traditional flows (per 
> direction, but ignore that for now).  If I open a new HTTP connection 
> to the same server, and coincidentally use the same source port, weeks 
> later, is that the same flow?

Per RFC 5101:

       A Flow is defined as a set of IP packets passing an Observation
       Point in the network during a certain time interval.


So if you define different time intervals (eg, "last week", "this week", 
and "next week") then yes, you've got two different flows there.

Whereas, if you define a interval which encompasses both of your 
connections, then you've only got one flow. And if your flow is going to 
last for weeks, then I hope you're reporting intermediate values.


> I had always thought of these as two flows, and the flowEndReason 
> implies it, but that would introduce some sort of time property as one 
> of the common property shared by the packets that make up a flow.  A 
> collector might aggregate the two reports, but removing the time 
> property is much like any other form of aggregation.

The time property is built in to the RFC 5101 definition.

P.


> It seems to me that we're using the timeout values of the cache as a 
> sort of ill-defined common property, but things get confusing when we 
> export total counts, or because the cache is low on resources, etc. 
>  Ideally, we'd want to be able to send more than one Flow Record for 
> the same Flow and provide enough information for the Collector to 
> reconstruct what the Monitoring Process is using to define a Flow.
>
>
> Cheers, Andrew