The flow model described by Claffy, Braun and Polyzos [15] defines a flow from a rather abstract point of view: A flow is a sequence of packets matching certain criteria, exchanged between two entities on a network. An example for such a flow could be all packets travelling through a certain point of a network that have identical source and destination IP network addresses.
Figure 2.2 shows the timings that are relevant for this definition of a flow. The circles on the time axis depict the arrival of data packets. The data packets which match the flow criteria are shown as red circles. The green arrows mark the ``flow timeout checkpoints''. At those points we check whether information that matches the flow criteria (or flow specification) has been received since the last checkpoint. If information was received, the flow is called ``current'' or ``active''. If no information for a flow was received during the interval, the flow timeout expires. The flow is then called ``inactive''. Any new packets that match the same flow criteria will then belong to a new flow.
Two parameters in this model have to be further investigated. The first is the flow specification, which is essential for the classification of arriving packets into flows, is to be examined. The second is the value of the flow timeout, which can be varied. It is interesting to see the influence this variation has on flow measurements. In the following sections, we will investigate those two parameters in detail.
