How is a network traffic flow uniquely identified?
What features/statistics of network traffic uniquely identifies a specific flow?
My initial thoughts were unique identifiers such as all packets going from eth_src to eth_dst and in and out of the same ports.
I have been using the Ryu Traffic Monitor to try and get my head around flows, it seems to use the in_port and eth_dst:
for stat in sorted([flow for flow in body if flow.priority == 1],
key=lambda flow: (flow.match['in_port'],
flow.match['eth_dst'])):
self.logger.info('%016x %8x %17s %8x %8d %8d',
ev.msg.datapath.id,
stat.match['in_port'], stat.match['eth_dst'],
stat.instructions[0].actions[0].port,
stat.packet_count, stat.byte_count)
python networking sdn ryu
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
add a comment |
What features/statistics of network traffic uniquely identifies a specific flow?
My initial thoughts were unique identifiers such as all packets going from eth_src to eth_dst and in and out of the same ports.
I have been using the Ryu Traffic Monitor to try and get my head around flows, it seems to use the in_port and eth_dst:
for stat in sorted([flow for flow in body if flow.priority == 1],
key=lambda flow: (flow.match['in_port'],
flow.match['eth_dst'])):
self.logger.info('%016x %8x %17s %8x %8d %8d',
ev.msg.datapath.id,
stat.match['in_port'], stat.match['eth_dst'],
stat.instructions[0].actions[0].port,
stat.packet_count, stat.byte_count)
python networking sdn ryu
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
add a comment |
What features/statistics of network traffic uniquely identifies a specific flow?
My initial thoughts were unique identifiers such as all packets going from eth_src to eth_dst and in and out of the same ports.
I have been using the Ryu Traffic Monitor to try and get my head around flows, it seems to use the in_port and eth_dst:
for stat in sorted([flow for flow in body if flow.priority == 1],
key=lambda flow: (flow.match['in_port'],
flow.match['eth_dst'])):
self.logger.info('%016x %8x %17s %8x %8d %8d',
ev.msg.datapath.id,
stat.match['in_port'], stat.match['eth_dst'],
stat.instructions[0].actions[0].port,
stat.packet_count, stat.byte_count)
python networking sdn ryu
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
What features/statistics of network traffic uniquely identifies a specific flow?
My initial thoughts were unique identifiers such as all packets going from eth_src to eth_dst and in and out of the same ports.
I have been using the Ryu Traffic Monitor to try and get my head around flows, it seems to use the in_port and eth_dst:
for stat in sorted([flow for flow in body if flow.priority == 1],
key=lambda flow: (flow.match['in_port'],
flow.match['eth_dst'])):
self.logger.info('%016x %8x %17s %8x %8d %8d',
ev.msg.datapath.id,
stat.match['in_port'], stat.match['eth_dst'],
stat.instructions[0].actions[0].port,
stat.packet_count, stat.byte_count)
python networking sdn ryu
python networking sdn ryu
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
asked Dec 29 '18 at 13:14
haltandhaveacoffeehaltandhaveacoffee
456
456
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Further investigation has helped me understand this more:
A network traffic flow is a flow of traffic from a source to a destination.
The answer to my specific question (which is in relation to transport protocols) is a network flow is defined as a 5-tuple consisting of a source IP address/port number, destination IP address/port number and the protocol in use. Ethernet addresses may also be added in here.
https://www.techopedia.com/definition/28190/5-tuple
edit: Thanks to Ron for mentioning that this is only valid for transport protocols that use ports
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53969889%2fhow-is-a-network-traffic-flow-uniquely-identified%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Further investigation has helped me understand this more:
A network traffic flow is a flow of traffic from a source to a destination.
The answer to my specific question (which is in relation to transport protocols) is a network flow is defined as a 5-tuple consisting of a source IP address/port number, destination IP address/port number and the protocol in use. Ethernet addresses may also be added in here.
https://www.techopedia.com/definition/28190/5-tuple
edit: Thanks to Ron for mentioning that this is only valid for transport protocols that use ports
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
add a comment |
Further investigation has helped me understand this more:
A network traffic flow is a flow of traffic from a source to a destination.
The answer to my specific question (which is in relation to transport protocols) is a network flow is defined as a 5-tuple consisting of a source IP address/port number, destination IP address/port number and the protocol in use. Ethernet addresses may also be added in here.
https://www.techopedia.com/definition/28190/5-tuple
edit: Thanks to Ron for mentioning that this is only valid for transport protocols that use ports
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
add a comment |
Further investigation has helped me understand this more:
A network traffic flow is a flow of traffic from a source to a destination.
The answer to my specific question (which is in relation to transport protocols) is a network flow is defined as a 5-tuple consisting of a source IP address/port number, destination IP address/port number and the protocol in use. Ethernet addresses may also be added in here.
https://www.techopedia.com/definition/28190/5-tuple
edit: Thanks to Ron for mentioning that this is only valid for transport protocols that use ports
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
Further investigation has helped me understand this more:
A network traffic flow is a flow of traffic from a source to a destination.
The answer to my specific question (which is in relation to transport protocols) is a network flow is defined as a 5-tuple consisting of a source IP address/port number, destination IP address/port number and the protocol in use. Ethernet addresses may also be added in here.
https://www.techopedia.com/definition/28190/5-tuple
edit: Thanks to Ron for mentioning that this is only valid for transport protocols that use ports
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
edited Jan 17 at 16:16
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
answered Jan 2 at 17:17
haltandhaveacoffeehaltandhaveacoffee
456
456
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
add a comment |
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
1
1
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
"a flow can be uniquely identified as traffic being sent from a eth_src + port number to an eth_dst + port number." That is only valid for transport protocols that use ports, e.g. TCP and UDP. Other transport protocols may use other types of addressing, or no addressing at all.
– Ron Maupin
Jan 2 at 17:22
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
Another way, for IPv6, would be to use the Flow Label in the IPv6 header. That is what it is for, although it hasn't seen much use, so far. The idea is that is simplifies identifying a flow. You do not need to look in the IPv6 payload to identify the transport protocol and decipher its header to get a port number, too.
– Ron Maupin
Jan 8 at 16:37
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53969889%2fhow-is-a-network-traffic-flow-uniquely-identified%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
