RFC 2724 (rfc2724) - Page 3 of 18


RTFM: New Attributes for Traffic Flow Measurement



Alternative Format: Original Text Document



RFC 2724                  RTFM: New Attributes              October 1999


      the timings altered.  A meter at the client's location would
      record different attributes for the same flow.

1.1  RTFM's Definition of Flows

   The RTFM Meter architecture views a flow as a set of packets between
   two endpoints (as defined by their source and destination attribute
   values and start and end times), and as BI-DIRECTIONAL (i.e. the
   meter effectively monitors two sub-flows, one in each direction).

   Reasons why RTFM flows are bi-directional:

      -  The WG is interested in understanding the behavior of sessions
         between endpoints.

      -  The endpoint attribute values (the "Address" and "Type" ones)
         are the same for both directions; storing them in bi-
         directional flows reduces the meter's memory demands.

      -  'One-way' (uni-directional) flows are a degenerate case.
         Existing RTFM meters can handle this by using one of the
         computed attributes (e.g. FlowKind) to indicate direction.

1.2  RTFM's Current Definition of Flows and their Attributes

   Flows, as described in the "Architecture" document [RTFM-ARC] have
   the following properties:

   a. They occur between two endpoints, specified as sets of attribute
      values in the meter's current rule set.  A flow is completely
      identified by its set of endpoint attribute values.

   b. Each flow may also have values for "computed" attributes (Class
      and Kind).  These are directly derived from the endpoint attribute
      values.

   c. A new flow is created when a packet is to be counted that does not
      match the attributes of an existing flow. The meter records the
      time when this new flow is created.

   d. Attribute values in (a), (b) and (c) are set when the meter sees
      the first packet for the flow, and are never changed.

   e. Each flow has a "LastTime" attribute, which indicates the time the
      meter last saw a packet for the flow.






Handelman, et al.             Experimental