26.7.1 The Flow Monitor

The QueueMonitor/ED/Flowmon class is responsible for managing the creation of new flow objects when packets arrive on previously unknown flows and for updating existing flow objects. Because it is a subclass of QueueMonitor, each flow monitor contains an aggregate count of packet and byte arrivals, departures, and drops. Thus, it is not necessary to create a separate queue monitor to record aggregate statistics. It provides the following OTcl interface:

classifier	get(set) classifier to map packets to flows
attach	attach a Tcl I/O channel to this monitor
dump	dump contents of flow monitor to Tcl channel
flows	return string of flow object names known to this monitor

The classifier function sets or gets the name of the previously-allocated object which will perform packet-to-flow mapping for the flow monitor. Typically, the type of classifier used will have to do with the notion of ``flow'' held by the user. One of the hash based classifiers that inspect various IP-level header fields is typically used here (e.g. fid, src/dst, src/dst/fid). Note that while classifiers usually receive packets and forward them on to downstream objects, the flow monitor uses the classifier only for its packet mapping capability, so the flow monitor acts as a passive monitor only and does not actively forward packets.

The attach and dump functions are used to associate a Tcl I/O stream with the flow monitor, and dump its contents on-demand. The file format used by the dump command is described below.

The flows function returns a list of the names of flows known by the flow monitor in a way understandable to Tcl. This allows tcl code to interrogate a flow monitor in order to obtain handles to the individual flows it maintains.