Re: [IPsec] comments on esp-null-heuristics-01

[Tero Kivinen <[e-mail]>]

Michael Richardson writes:
>     Tero> How does that disagree in their definition of flow?
> 
> A flow in the routing and ASIC space is an origin/destination IP address
> pair only.  A microflow is the 5-tuple.

Never heard about microflow before.

Wikipedia says:

    Applied to Internet routers, a flow may be a host-to-host
    communication path, or a socket-to-socket communication identified
    by a unique combination of source and destination addresses and
    port numbers, together with transport protocol (for example, UDP
    or TCP). In the TCP case, a flow may be a virtual circuit, also
    known as a virtual connection or a byte stream.

It also says it could be "a sequence of packets from a source computer
to a destination", which would match other flow definition, so I guess
there is no one standardized definition...

Wikipedia does not know anything about microflows...

RFC2474 seems to be the one which defines microflow, and RFC2991
defines flow to be "represent the granularity at which the router
keeps state", which might be just source and destination addresses, or
it might contain protocol id, and RFC2991 also says that "flow" is not
necessarily synonymous with the term "microflow", but does not also
say it cannot be.

Deep inspection engines usually keep state on granularity of port
numbers, so I do not think the flow definition we use here is
inheritly different from RFC 2991.

Then for example rfc4821 (Packetization Layer Path MTU Discovery)
defines flow to be:

Flow:  A context in which MTU Discovery algorithms can be invoked.
      This is naturally an instance of a Packetization Protocol, for
      example, one side of a TCP connection.

and RFC5626 (Managing Client-Initiated Connections in the Session
Initiation Protocol (SIP)) says:

   Flow:  A Flow is a transport-layer association between two hosts that
      is represented by the network address and port number of both ends
      and by the transport protocol.  For TCP, a flow is equivalent to a
      TCP connection.  For UDP a flow is a bidirectional stream of
      datagrams between a single pair of IP addresses and ports of both
      peers.  With TCP, a flow often has a one-to-one correspondence
      with a single file descriptor in the operating system.

so I do not think there is one agreed on definition of flow.

>     Tero> On the other hand it really does not matter whether it
>     Tero> disagrees or not, this is what we mean by flow in this
>     Tero> document, so as we define it there, it should be clear for
>     Tero> people what we mean by flow. 
> 
> Well, your document will be read by ASIC designers and they already have
> a definition of flow and microflow, and if you want to confuse them,
> then that's fine.

I do not want to use definition that would confuse all others either.
It is bad if one group of people is confused, but don't really want to
confuse other people by using term they do not know (including me).

Perhaps the best way is to say in the terminology definition of flow
that in some context (diffserv and bhp) this is called microflow.
-- 
[e-mail]