Talk:Traffic flow (computer networking)

	This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing articles
Mid	This article has been rated as Mid-importance on the project's importance scale.
	This article is supported by Networking task force (assessed as High-importance).

Notes[edit]

Flow Monitoring: http://www.slac.stanford.edu/xorg/nmtf/nmtf-tools.html#flow-com

This is a good list of tools used to monitor traffic flows at a point, or in several points in a network. Perhaps this can be expanded into a section on traffic flow tools. kgrr ^talk 14:17, 25 March 2010 (UTC)[reply]

Traffic flow types[edit]

The article needs a section to flesh this out a little:

Terminal/host
Client/server
Thin client
Peer-to-peer
Server/server
Distributed computing

65.161.188.11 (talk) 19:06, 15 March 2010 (UTC)[reply]

I'm not sure if the end points of a flow are as important as characteristics such as bandwidth, length, and burstiness. kgrr ^talk 14:19, 25 March 2010 (UTC)[reply]

Undeleted sections - citations NOT needed[edit]

The comment when much of the page was deleted was 'Deleted the unsupported nonsense. (No references provided after two months)'. But the page that replaced it was only about TCP flow, e.g. the 3 way handshake, which is better covered in the main page: Transmission Control Protocol. I'm not sure what is meant by 'unsupported nonsense', as all of this is basic stuff. Really too basic and uncontroversial to need citing.

I think the point about this page is it is NOT meant to be about TCP, but about all the uses of the term 'flow' in telecommunications and computer networking. This will include TCP, but there are lots of other protocols and even non-protocols, e.g. the use of flow when traffic flows are being modelled by a graph. Aarghdvaark (talk) 12:48, 25 March 2010 (UTC)[reply]

Ararghdvaark, You are right. The point about this page is traffic flows. What I deleted had to do with routes. Flows are not routes through networks. Flows are groups of packets at one point in the network - at a router (e.g. Netflow) or at a monitoring point in the network (e.g. off of a span port in a network to a server running a tool) Perhaps I was not specific about it in calling it nonsense. I gave the TCP flows as an example, showing as to how it causes two flows. I have now given more examples for other transport protocols - UDP and ICMP. Other transport protocols behave the same. Higher level protocols ride on top of transport protocols. kgrr ^talk 14:15, 25 March 2010 (UTC)[reply]

Hi kgrr. I think your examples are still too TCP/IP specific, for example in the main section 'Conceptual description' you say 'A flow can be uniquely identified by the following parameters within a certain time period: Source and Destination IP address; Source and Destination Port; Layer 4 Protocol (TCP/UDP/ICMP)'. Obviously this only applies to TCP/IP, and the reference to layer 4 only works by accident with the OSI model. What about ATM for example?

Layer 4 only works by accident ... right TCP/IP does not match into the OSI model. You know what I mean TCP/IP layer 4 as in transport layer. ATM is a layer 3 network protocol. It's cells can carry IP traffic. And then flows can be observed in groups of packets. What's the problem? kgrr ^talk 01:02, 27 March 2010 (UTC)[reply]

Obviously TCP/IP is the most important protocol stack, but it is not the only one. For example there was X.25. So any use of TCP/IP protocols should make it clear that they are only examples and the reader should not be expected to assume TCP/IP all the time. Hence I added 'TCP/IP' in the main text. However it seems to me that this description 'A TCP/IP flow can be uniquely identified by the following parameters within a certain time period: ...' actually contradicts RFC 3697? Specifically the bit 'However, a flow is not necessarily 1:1 mapped to a transport connection'

The main title is traffic flow. The article seems to assume this is the same as packet flow, but ATM cell flow, layer 2 frame flow, or even TCP segment flow could also count as traffic flow? So I think the article needs to be kept general. Aarghdvaark (talk) 12:10, 28 March 2010 (UTC)[reply]

And I'm not sure about your distinction between flows and routes. In a virtual circuit such as TCP, packets may go different routes but be considered one flow, OTOH in a pinned route environment such as with MPLS all packets (or frames) in one flow will go the same route. In fact your description above of a flow as 'groups of packets at one point in the network - at a router (e.g. Netflow)' does not work for TCP, as an odd packet in that flow may go a different route! Aarghdvaark (talk) 18:36, 26 March 2010 (UTC)[reply]

Again, flows have nothing to do with routes. Flows are packets with the same source address, source port, destination address and destination port, same TOS bits. Do you somehow equate a flow to something that traceroute produces? Like a list of IP addresses? MAC addresses? And, Absolutely, the concept of flow works with TCP. In the case of load sharing (where some packets go one way and other packets go another way), the observed flow at one router before the load balancer may see twice the flow as two routers down two different paths or routes through the network. kgrr ^talk 01:02, 27 March 2010 (UTC)[reply]

This is getting philosophical, as in 'you can never step in the same river twice'! Your idea of a flow seems to me to be specific in time and place, closely following RFC 3917, so that if we have a pinned route and no packet loss, etc., with packets going SRC - ROUTER A - ROUTER B - DEST, then I think you'd say the flow observed at ROUTER A is not the same flow as observed at ROUTER B. Whereas I'd follow RFC 3697 and say they were the same flow ('sequence of packets sent from a particular source to a particular ... destination that the source desires to label as a flow'). Hence although I would not say a list such as SRC, ROUTER A, ROUTER B, DEST defines a flow, I would say it defines the route (or more generally the path) of a flow? Aarghdvaark (talk) 12:10, 28 March 2010 (UTC)[reply]

Citations[edit]

Hi kgrr, I've removed (again) those requests for citations, for the specific reasons given below. I'm unclear about why you want those citations anyway - so it's probably easier for you to find citations than simply put in a tag saying you want someone else to find the citations you want? Cheers Aarghdvaark (talk) 18:01, 26 March 2010 (UTC)[reply]

I simply don't buy the claims that are being made in the text given by Wikipedia. It may be "obvious" to you, but I don't buy it. Find me a reference to back the claims. kgrr ^talk 00:46, 27 March 2010 (UTC)[reply]

citation 1: 'In the TCP case, a flow may be a virtual circuit, also known as a virtual connection or a byte stream.[citation needed]' - follow the link to virtual circuit, where it says: 'Layer 4 virtual circuits - Connection oriented transport layer datalink protocols such as TCP[1][2] may rely on a connectionless packet switching network layer protocol such as IP, where different packets may be routed over different paths, and thus be delivered out of order. However, a virtual circuit[2][3][4] is possible since TCP includes segment numbering and reordering on the receiver side to prevent out-of-order delivery'

yes, I understand that TCP can be carried in a VC. But flows have nothing to do with routes. A flow is a grouping of packets observed at one point in the network. kgrr ^talk 00:46, 27 March 2010 (UTC)[reply]

citation 2: 'In packet switches, the flow may be identified by IEEE 802.1Q Virtual LAN tagging in Ethernet networks, or by a Label Switched Path in MPLS tag switching.[citation needed]' - follow the link to MPLS where it says: 'MPLS can make use of existing ATM network infrastructure, as its labeled flows can be mapped to ATM virtual circuit identifiers, and vice versa'

I suppose if you looked at a VLAN at one point in the network, a VLAN is like a layer 2 flow, but it fits none of the RFCs definitions of flow. And, MPLS is another example of a packet encapsulated by headers. It's like a layer 2/2.5/3 flowish thing. But again, it does not fit the RFCs definitions of flows. kgrr ^talk 00:46, 27 March 2010 (UTC)[reply]

RFCs only apply to TCP/IP. But the IP packets are carried over some layer 2 network e.g. 802.1Q which is typically standardized by the IEEE initially before becoming taken on as an ISO standard. This is where the OSI RM comes in rather than the TCP/IP protocol stack. Aarghdvaark (talk) 12:30, 28 March 2010 (UTC)[reply]

citation 3: 'It is also a concept used in network analyzers or in packet tracing.[citation needed]' - but isn't it obvious that the concept of a flow would be used in packet tracing?

no .. many packet tracers / network analyzers such as Netscout for example are not able to recognize that a series of packets belong together as one flow. You need something like Netflow in order to identify flows. kgrr ^talk 00:46, 27 March 2010 (UTC)[reply]

But even the free Ethereal s/w protocol analyzer can be used to monitor specific flows? Aarghdvaark (talk) 12:30, 28 March 2010 (UTC)[reply]

Actually, the free Wireshark protocol analyzer (Ethereal does not exist anymore) cannot identify various flows. kgrr ^talk 05:37, 17 November 2010 (UTC)[reply]

Pocket traffic[edit]

What it is it 2401:4900:4BCC:FF9:1:0:78D2:9947 (talk) 17:00, 22 September 2022 (UTC)[reply]