Motiviation For a New Flow Definition

The practical use of such connection based flows is however restricted. Although the theory exists already for a while, it has never really been used in implementations. This is due to some problems which are related to the nature of the Internet environment:

1.

The Internet being a connectionless datagram environment, dependence on connection-oriented information will often interfere with operational stability. If routes change during a flow, new routers will carry datagrams that never saw the transport layer SYN/SYN-ACK packets, and routers that did see earlier datagrams in a flow will never see the FIN/FIN-ACKs. Flow state information that is dependent on this data will become obsolete and never expired in such cases.

2.

IP Fragmentation would also pose problems since all but the first fragment lack the TCP/UDP port information and therefore it would be impossible to track the fragmenented parts of a packet into a higher layer flow.

3.

Routing and accounting in a datagram network occurs below the transport layer. Rerouting could occur. Upon a route change of a non-static route during flow data capturing the FIN packet for a connection would never be seen and therefore the flow data structure would exist forever.

4.

Not all traffic makes use of connection oriented transport layer protocols. The trend on the Internet is that more and more lightweight protocols are used that do not use the TCP mechanism for connection setup and teardown. Especially new multimedia applications usually bring their own concepts for connection handling.

5.

Finally, new technologies for link level routers, e.g. ATM, will not have access to transport layer informations; any Internet related transmission decisions will have to rely only on IP level information. In particular, until end-to-end ATM is a reality, IP gateways attached to ATM style networks will have to multiplex possibly many IP flows onto ATM. Mapping higher level (IP) flows to underlying link level virtual circuits (VCs) will require effective setup, maintenance and timeout strategies as well as accounting schemes.

Having seen the efforts to extend the packet train model of flows to the transport or application layers [1,23,26] or focusing on TCP traffic flows [10,32], Claffy, Braun and Polyzos have introduced a more generalized, comprehensive methodology of a timeout-based flow characterization on the IP layer [15]. Their flow definition is also based on the packet-train model, but in contrary to the other models mentioned they avoid to use connection information.

The IP layer, the ``heart'' of internet technology, is a connectionless network layer. Not to use connections for routing or switching was one of the main reasons why the Internet could grow as rapidly as it did. Any connection oriented service on the Internet is implemented in the transport protocol that is running on the end hosts only. Routers on the Internet are simple and fast since they just rely on the IP headers of the packets. This has shown to scale very well. In the same way, the connectionless techniques are scaleable for measurement and analysis applications.

The classification of networks into either connectionless or connection oriented ones is pretty restrictive. In particular it is obviously not true that in a connectionless network all datagrams are completely independent. The datagrams are certainly switched independently, but it is usually the case that a stream of datagrams between a particular pair of hosts flow through a particular set of routers. Hence the idea to define a flow as a sequence of packets matching the same criteria is a useful concept for an abstraction.

By using this abstraction of connectionless traffic flows, a set of new applications will become possible. First of all, we can use the flows for network monitoring, measurement and analysis, as primarily shown in this report. However, they are also very interesting for routing, switching, as we will see in section 2.5 as well as for congestion control ([20], pp. 395 ff).