The Study on Difference among Flow Specifications in Internet

Aggregate flow is the base methodology of network measurement and the orientation of next generation network management. For the same data, different flow specifications lead to different results, and the costs also vary significantly. To analyze the correlations among specifications, we select seven wide used specifications and calculate their single disparity degree and comprehensive similarity degree based on seven metrics: average flow number per second, average active flow number per second, average hold flow number per second, average flow recreate time, recreate flow number, unique flow number and aggregate flow cost. Comprehensive evaluation standard shows that the difference among flow specifications is less than 20%, and the specification of 16sec-5-tuple is significantly similar with 15sec-NetFlow. Moreover, the similarity between specifications of 2-tuple and 3-tuple granularity with the same timeout value is great, while 3-tuple costs comparatively less. We also summarize the correlations between specifications from the perspective of all the single metrics.