Flow (Internet Protocol)
While the Internet Protocol is connectionless, capacity planning of networks needs an understanding of aggregate traffic, which is commonly defined in measurement of flows. At a minimum, a flow is identified by a source and destination IP address; it may be further refined by information such as IP protocol identifier, and TCP or UDP source and destination port numbers. Yet additional distinctions may be made among flows based on their quality of service flags.
Internet Protocol flow information export is the general term for methods to collect and report flow statistics. A formal definition of a flow, in the context of measurement with the IPFIX protocol recommendation, is: "A set of IP packets passing an Observation Point in the network during a certain time interval. All packets belonging to a particular Flow have a set of common properties. Each property is defined as the result of applying a function to the values of:
- one or more packet header fields (e.g., destination IP address), transport header fields (e.g., destination port number), or application header fields (e.g., RTP header fields ).
- one or more characteristics of the packet itself (e.g., number of Multi-Protocol Label Switching (MPLS) labels, etc...).
- one or more of fields derived from packet treatment (e.g., next hop IP address, the output interface, etc...).
"A packet is defined as belonging to a Flow if it completely satisfies all the defined properties of the Flow."
- Quittek, J., Zseby, T., Claise, B., and S. Zander (October 2004), Requirements for IP Flow Information Export, RFC 3917
- B. Claise, ed. (January 2008), Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information, RFC 5101
- Schulzrinne, H.; S. Casner & R. Frederick et al. (July 2003), RTP: A Transport Protocol for Real-Time Applications, Internet Engineering Task Force, RFC3550