RFC 2724 (rfc2724) - Page 2 of 18
RTFM: New Attributes for Traffic Flow Measurement
Alternative Format: Original Text Document
RFC 2724 RTFM: New Attributes October 1999
2.5 Group Attributes . . . . . . . . . . . . . . . . . . . . . 8
2.6 Actions on Exceptions . . . . . . . . . . . . . . . . . . .10
3 Extensions to the 'Basic' RTFM Meter . . . . . . . . . . . . .10
3.1 Flow table extensions . . . . . . . . . . . . . . . . . . .10
3.2 Specifying Distributions in RuleSets . . . . . . . . . . .11
3.3 Reading Distributions . . . . . . . . . . . . . . . . . . .13
4 Extensions to the Rules Table, Attribute Numbers . . . . . . .13
5 Security Considerations . . . . . . . . . . . . . . . . . . . .15
6 References . . . . . . . . . . . . . . . . . . . . . . . . . .16
7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . .17
8 Full Copyright Statement . . . . . . . . . . . . . . . . . . .18
1 Introduction
The Real-Time Flow Measurement (RTFM) Working Group (WG) has
developed a system for measuring and reporting information about
traffic flows in the Internet. This document explores the definition
of extensions to the flow measurements as currently defined in
[RTFM-ARC]. The new attributes described in this document will be
useful for monitoring network performance and will expand the scope
of RTFM beyond simple measurement of traffic volumes. A companion
document to this memo will be written to define MIB structures for
the new attributes.
This memo was started in 1996 to advance the work of the RTFM group.
The goal of this work is to produce a simple set of abstractions,
which can be easily implemented and at the same time enhance the
value of RTFM Meters. This document also defines a method for
organizing the flow abstractions to augment the existing RTFM flow
table.
Implementations of the RTFM Meter have been done by Nevil Brownlee in
the University of Auckland, NZ, and Stephen Stibler and Sig Handelman
at IBM in Hawthorne, NY, USA. The RTFM WG has also defined the role
of the Meter Reader whose role is to retrieve flow data from the
Meter.
Note on flows and positioning of meters:
A flow as it traverses the Internet may have some of its
characteristics altered as it travels through Routers, Switches,
and other network units. It is important to note the spatial
location of the Meter when referring to attributes of a flow. An
example, a server may send a sequence of packets with a definite
order, and inter packet timing with a leaky bucket algorithm. A
meter reading downstream of the leaky bucket would record a set
with minimal inter packet timing due to the leaky bucket. At the
client's location, the packets may arrive out of sequence, with
Handelman, et al. Experimental