Subject: [ipfix-arch] definition of uni-/bi-directional flows

From: [email-masked]
Date: Mon, 11 Feb 2002 02:13:39 +0100 (CET)

Hi all,

I just ran into a strange problem: I tried to define precisely
what is a uni-directional / bi-directional flow and found out
that although I am discussing with you for quite some time 
using these terms, I cannot tell precisely, what they are.

Does anyone have such a definition? 

Of course I can define them easily when I restrict flows to 
5-tuple TCP/UDP flow without wild-carding, but when I start to 
include aggregated flows, for example all packets originating 
in a specific subnet, and ICMP flows, and multicast flows 
(multi-directional?), then it gets much more complicated.

    Juergen

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Ganesh Sadasivan <[email-masked]>
Date: Mon, 11 Feb 2002 11:00:38 -0800

Hi Jurgene,
   Refer to section 2.0 of the draft submitted by Benoit and me. It
   gives a detailed defintion of a uni-directional flow.  Bi-directional
   is a restricted set of uni-directional flows which have a sensible
   reverse mapping at the same observation point. I am not sure to
   what precision one can define a bi-directional flow.

Thanks
Ganesh

---

From: Juergen Quittek <[email-masked]>
Date: Mon, 11 Feb 2002 20:11:14 +0100

Hi Ganesh,

>    what precision one can define a bi-directional flow.

The flows you define are not necessarily what intuition would call
uni-directional. If you for example map all traffic with a source
or destination port 80 into one flow I would not call it uni-directional.

What you do is that you define a general flow and then say the regular
case is the uni-directional one, and bi-directional is some special
kind. My claim is that already uni-directional is a special kind, which
we have not defined yet, although we all might have a good intuition
teeling us what would be a uni-directional or bi-directional flow.

Best wishes,

    Juergen
-- 
Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

---

From: Ganesh Sadasivan <[email-masked]>
Date: Mon, 11 Feb 2002 11:43:09 -0800

Hi Jurgene,
  You are correct. What I should have added is:
   When the direction w.r.t wire is specified, then it can be furthur
   categorised as uni/bi.. The direction however is optional and may
   not be applicable in all the cases. I beleive the scope of the flow is
   restricted to an observation point and not end-to-end.
Thanks
Ganesh

---

From: "K.C. Norseth" <[email-masked]>
Date: Mon, 11 Feb 2002 23:15:53 -0700

Ganesh,

Can you expand on what your revised text will be?

K.C.

----- Original Message -----
From: Ganesh Sadasivan <[email-masked]>
To: Juergen Quittek <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, February 11, 2002 12:43 PM
Subject: Re: [ipfix-arch] definition of uni-/bi-directional flows

| Hi Jurgene,
|   You are correct. What I should have added is:
|    When the direction w.r.t wire is specified, then it can be furthur
|    categorised as uni/bi.. The direction however is optional and may
|    not be applicable in all the cases. I beleive the scope of the flow is
|    restricted to an observation point and not end-to-end.
| Thanks
| Ganesh
|
| Juergen Quittek wrote:
|
| > Hi Ganesh,
| >
| > --On 11 February 2002 11:00 -0800 Ganesh Sadasivan wrote:
| >
| > > Hi Jurgene,
| > >    Refer to section 2.0 of the draft submitted by Benoit and me. It
| > >    gives a detailed defintion of a uni-directional flow.
Bi-directional
| > >    is a restricted set of uni-directional flows which have a sensible
| > >    reverse mapping at the same observation point. I am not sure to
| > >    what precision one can define a bi-directional flow.
| >
| > The flows you define are not necessarily what intuition would call
| > uni-directional. If you for example map all traffic with a source
| > or destination port 80 into one flow I would not call it
uni-directional.
| >
| > What you do is that you define a general flow and then say the regular
| > case is the uni-directional one, and bi-directional is some special
| > kind. My claim is that already uni-directional is a special kind, which
| > we have not defined yet, although we all might have a good intuition
| > teeling us what would be a uni-directional or bi-directional flow.
| >
| > Best wishes,
| >
| >     Juergen
| > --
| > Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
| > NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
| > Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de
| >
| > >
| > > Thanks
| > > Ganesh
| > >
| > > [email-masked] wrote:
| > >
| > >> Hi all,
| > >>
| > >> I just ran into a strange problem: I tried to define precisely
| > >> what is a uni-directional / bi-directional flow and found out
| > >> that although I am discussing with you for quite some time
| > >> using these terms, I cannot tell precisely, what they are.
| > >>
| > >> Does anyone have such a definition?
| > >>
| > >> Of course I can define them easily when I restrict flows to
| > >> 5-tuple TCP/UDP flow without wild-carding, but when I start to
| > >> include aggregated flows, for example all packets originating
| > >> in a specific subnet, and ICMP flows, and multicast flows
| > >> (multi-directional?), then it gets much more complicated.
| > >>
| > >>     Juergen
| > >>
| > >> --
| > >> Help        mailto:[email-masked] and say "help" in
message body
| > >> Unsubscribe mailto:[email-masked] and say
| > >> "unsubscribe ipfix" in message body
| > >> Archive     http://ipfix.doit.wisc.edu/archive/
| > >
|
|
| --
| Help        mailto:[email-masked] and say "help" in message
body
| Unsubscribe mailto:[email-masked] and say
| "unsubscribe ipfix" in message body
| Archive     http://ipfix.doit.wisc.edu/archive/
|

---

From: Ganesh Sadasivan <[email-masked]>
Date: Tue, 12 Feb 2002 08:32:01 -0800

KC,
  This may require some more refinement..

  Let {KF1,KF2.., KFn} define the set of fields consisting
  of atleast one of :
   a . one or more of packet header fields
   b. one or more properties of the packet itself
   c. one or more of fields derived from packet treatment

  The corresponding flow is F(KF1,KF2.., KFn). If the flow has
  any characteristics which  pertain to a direction w.r.t to the
  wire, then it is a uni-directional flow.
  Say <KFi, KFj> forms a  pair which defines the <source, destination>
  characteristic in a direction w.r.t wire. If <KFj, KFi> defines the
  <source, destination> in the other direction w.r.t the wire, then
  Bi-directional flow can be defined as
  F(KF1,.. <KFj,KFi | KFi,KFJ> , ...KFn).
  Where "|" means "OR" and <> just delimits the internal set.

Ganesh