RFC 2722 (rfc2722) - Page 3 of 48

Traffic Flow Measurement: Architecture

RFC 2722         Traffic Flow Measurement: Architecture     October 1999


1  Statement of Purpose and Scope

1.1  Introduction

   This document describes an architecture for traffic flow measurement
   and reporting for data networks which has the following
   characteristics:

     - The traffic flow model can be consistently applied to any
       protocol, using address attributes in any combination at the
       'adjacent' (see below), network and transport layers of the
       networking stack.

     - Traffic flow attributes are defined in such a way that they are
       valid for multiple networking protocol stacks, and that traffic
       flow measurement implementations are useful in multi-protocol
       environments.

     - Users may specify their traffic flow measurement requirements by
       writing 'rule sets', allowing them to collect the flow data they
       need while ignoring other traffic.

     - The data reduction effort to produce requested traffic flow
       information is placed as near as possible to the network
       measurement point.  This minimises the volume of data to be
       obtained (and transmitted across the network for storage), and
       reduces the amount of processing required in traffic flow
       analysis applications.

   'Adjacent' (as used above) is a layer-neutral term for the next layer
   down in a particular instantiation of protocol layering. Although
   'adjacent' will usually imply the link layer (MAC addresses), it does
   not implicitly advocate or dismiss any particular form of tunnelling
   or layering.

   The architecture specifies common metrics for measuring traffic
   flows.  By using the same metrics, traffic flow data can be exchanged
   and compared across multiple platforms.  Such data is useful for:

     - Understanding the behaviour of existing networks,

     - Planning for network development and expansion,

     - Quantification of network performance,

     - Verifying the quality of network service, and

     - Attribution of network usage to users.



Brownlee, et al.             Informational