RFC 2722 (rfc2722) - Page 3 of 48
Traffic Flow Measurement: Architecture
Alternative Format: Original Text Document
RFC 2722 Traffic Flow Measurement: Architecture October 1999
1 Statement of Purpose and Scope
1.1 Introduction
This document describes an architecture for traffic flow measurement
and reporting for data networks which has the following
characteristics:
- The traffic flow model can be consistently applied to any
protocol, using address attributes in any combination at the
'adjacent' (see below), network and transport layers of the
networking stack.
- Traffic flow attributes are defined in such a way that they are
valid for multiple networking protocol stacks, and that traffic
flow measurement implementations are useful in multi-protocol
environments.
- Users may specify their traffic flow measurement requirements by
writing 'rule sets', allowing them to collect the flow data they
need while ignoring other traffic.
- The data reduction effort to produce requested traffic flow
information is placed as near as possible to the network
measurement point. This minimises the volume of data to be
obtained (and transmitted across the network for storage), and
reduces the amount of processing required in traffic flow
analysis applications.
'Adjacent' (as used above) is a layer-neutral term for the next layer
down in a particular instantiation of protocol layering. Although
'adjacent' will usually imply the link layer (MAC addresses), it does
not implicitly advocate or dismiss any particular form of tunnelling
or layering.
The architecture specifies common metrics for measuring traffic
flows. By using the same metrics, traffic flow data can be exchanged
and compared across multiple platforms. Such data is useful for:
- Understanding the behaviour of existing networks,
- Planning for network development and expansion,
- Quantification of network performance,
- Verifying the quality of network service, and
- Attribution of network usage to users.
Brownlee, et al. Informational