search

jsommers / fs

The fs flow record generator / network simulator.
GNU General Public License v2.0
21 stars 10 forks source link

What's the flow export format? #1

Closed Dave1991 closed 10 years ago

Dave1991 commented 10 years ago

Hi,I am using your simulation tools.But I can't understand the format of the flow export files.For example,what's the meaning of each column of the following line? textexport a 0.016469 0.016469 0.321625 10.1.0.1:22->10.3.1.1:25833 tcp 0x0 harpoon:172.16.0.1 5 4373 FSA I am looking forward to your reply as soon as possible.

jsommers commented 10 years ago

The fields are: type of export (always textexport) node name at which flow was observed (a) sim time at which flow started sim time at which flow ended sim time at which flow record was written source IP addr:source port->dest IP addr:dest port protocol type of service (0x0) identifier to indicate which interface arrived on the node at which flow is observed (shows harpoon:172.16.0.1 to indicate that it arrived from a harpoon generator node, and the IP address assigned to the interface on node a on which the traffic arrived) number of packets in flow (5) number of bytes in flow (4373) TCP flags observed in flow (FIN | SYN | ACK)

Sorry for not seeing your question earlier --- I was away for the last couple weeks.

Dave1991 commented 10 years ago

Thanks for your reply.But now I have another problem---how to calculate the transfer speed of a flow?According to the flow export,I can only get the sim time and flowsize without the transfer delay.Do you have another way to calculate the speed.:)

jsommers commented 10 years ago

The flow record has the flow start time and the flow end time as well as the size in bytes --- what more do you need?

Dave1991 commented 10 years ago

Hey,it's Dave,too.I couldn't get the flow start time and the flow end time yet.Because In a node's record,the start time is equal to the end time.For example,in node a record,one textexport shows as following: textexport a 3.272589 3.272589 3.428036 10.1.0.3:1000->10.2.0.1:2000 tcp 0x0 harpoon:172.16.0.1 5 4341 FSA The start time is 3.272589s and the end time is 3.272589s.But how can it be possible? By the way,I really want to know one textport represent one flow or one chunk of one flow. I am looking forward to your reply.