Defining Flows

Stateful Flow Management
Platform
Napatech SmartNIC
Content Type
User Guide
Capture Software Version
Link™ Capture Software 12.11

The definition of a flow can be fluid. This section describes different flow definitions and shows how the Napatech stateful flow management supports various flow definitions.

Understanding a flow

A flow can refer to any of the following:
  • A sequence of packets from a source to a destination (host, multicast group or broadcast domain).
  • An artificial, logical equivalent to a call or connection.
  • A sequence of frames sent from a particular source to a particular unicast, anycast or multicast destination that the source desires to label as a flow. A flow can consist of all frames in a specific transport connection or media stream. A flow is not necessarily mapped 1-to-1 to a transport connection.
  • A set of IP packets passing an observation point in the network during a certain time interval.

Defining flows with flexibility

Flow definition is implementation specific depending on user requirements. Flows can be defined based on various header fields using the Napatech stateful flow management as shown in the following examples:
  • Traditional 5 tuple: Source/destination IP addresses, layer 4 source/destination port numbers and IP protocol.
  • Traditional 4 tuple: Source/destination IP addresses and layer 4 source/destination port numbers.
  • Traditional 2 tuple: Source and destination IP addresses.
  • Source and destination IP addresses, VLAN tag 1 and VLAN tag 2.
  • Source and destination MAC addresses.
The following examples show how to define flows using NTPL commands.
Delete=All
// Define fields for VLAN tag 1/2, Source/destination IP addresses
// and layer 4 source/destination port numbers
Define VlanId1 = Field(FirstVLAN[2]/16)
Define VlanId2 = Field(FirstVLAN[6]/16)
Define IPv4Src = Field(Layer3Header[12]/32)
Define Ipv4Dst = Field(Layer3Header[16]/32)
Define DstPort = Field(Layer4Header[0]/16)
Define SrcPort = Field(Layer4Header[2]/16)

// Define Key Type
KeyType[name=KT] = {16, 16, 32, 32, 16, 16}

// Define keys
KeyDef[name=KD; KeyType=kt; IpProtocolField=Outer] = ({0xFFF:VlanId1}, \\
 {0xFFF:VlanId2}, IPv4Src, IPv4Dst, SrcPort, DstPort)
VLAN tag 1/2, source/destination IP addresses, layer 4 source/destination port numbers and IP protocol fields are selected to identify flows in this example.
Delete=All
// Define fields for source and destination MAC addresses
Define MacDsc = Field(Layer2Header[0]/64)
Define MacSrc = Field(Layer2Header[6]/64)

// Define Key Type
KeyType[name=KT_L2] = {64, 64}

// Define keys
KeyDef[name=KD_L2; KeyType=KT_L2] = ({0xFFFFFFFFFFFF0000:MacDsc}, \\
 {0xFFFFFFFFFFFF0000:MacSrc})
In this example Source and destination MAC addresses are used to identify flows.
Note: Total size of fields for the KeyType command can be up to 320 bits (40 bytes). It consists of two 128-bit and two 32-bit data. The defined fields must be subsets of these two 128-bit and two 32-bit data. The number of fields are not limited as long as the defined fields fit into two 128-bit and two 32-bit data structure.
Note: Up to 32 KeyDefs can be defined.