RFC 2724 (rfc2724) - Page 3 of 18
RTFM: New Attributes for Traffic Flow Measurement
Alternative Format: Original Text Document
RFC 2724 RTFM: New Attributes October 1999
the timings altered. A meter at the client's location would
record different attributes for the same flow.
1.1 RTFM's Definition of Flows
The RTFM Meter architecture views a flow as a set of packets between
two endpoints (as defined by their source and destination attribute
values and start and end times), and as BI-DIRECTIONAL (i.e. the
meter effectively monitors two sub-flows, one in each direction).
Reasons why RTFM flows are bi-directional:
- The WG is interested in understanding the behavior of sessions
between endpoints.
- The endpoint attribute values (the "Address" and "Type" ones)
are the same for both directions; storing them in bi-
directional flows reduces the meter's memory demands.
- 'One-way' (uni-directional) flows are a degenerate case.
Existing RTFM meters can handle this by using one of the
computed attributes (e.g. FlowKind) to indicate direction.
1.2 RTFM's Current Definition of Flows and their Attributes
Flows, as described in the "Architecture" document [RTFM-ARC] have
the following properties:
a. They occur between two endpoints, specified as sets of attribute
values in the meter's current rule set. A flow is completely
identified by its set of endpoint attribute values.
b. Each flow may also have values for "computed" attributes (Class
and Kind). These are directly derived from the endpoint attribute
values.
c. A new flow is created when a packet is to be counted that does not
match the attributes of an existing flow. The meter records the
time when this new flow is created.
d. Attribute values in (a), (b) and (c) are set when the meter sees
the first packet for the flow, and are never changed.
e. Each flow has a "LastTime" attribute, which indicates the time the
meter last saw a packet for the flow.
Handelman, et al. Experimental