Flows - Active and Recent

Monitoring > Bandwidth > Flows > Active & Recent Flows

Use the Flows tab to view, filter, and manage flows for all your appliances or the appliances you select in the appliance tree.

The following table describes the filters displayed in the top portion of the Flows tab.

NOTE: For a detailed walkthrough of how to use the Flows page, see HPE Aruba Networking’s 5-part “Monitoring > Flows” video series here: How To and Technical Videos.

Segment and Zone Filters

The Segment and Zone fields in the top portion of the Flows tab work together to filter flows that display in the Flows table based on your segment and firewall zone selections. The Segment filter is available only if routing segmentation is enabled.

The following table details the various Segment and Zone filter settings. Keep in mind that for both segment and zone, either means that filtered flows will be either sourced from or destined to the selected segment or zone. For a Segment either condition, only one Segment field is displayed; for a Zone either condition, only one Zone field is displayed.

• Click the Src <-> Dest icon () associated with the Segment filter to toggle between displaying only one Segment field (the either option) and displaying two fields (source on the left and destination on the right).

• The From:To check box associated with the Zone filter functions similarly. Clear this check box to display only one Zone field (the either option). Select it to display the From and To fields.

Filter Field

You can use the Filter field to configure specific filters. The drop-down menu displays a list of default filters you can apply to your flows. Click the edit icon to add, edit, or delete filters.

To add a filter:

1. Click the edit icon next to the Filter field.

2. Create a filter or select one from the list.

3. Click +Add.

4. Click Save.

You can also select the history tab with the two arrows next to the Filter field if you want to go back to a previously applied filter. A maximum of 20 previously applied filters can be saved.

Reset or Reclassify Flows

• You can Reclassify or Reset [Selected / All Returned / All] flows:

  • Resetting the flow kills it and restarts it. It is service-affecting.

  • Reclassifying the flow is not service-affecting. When policy changes occur, flow reclassification makes a best-effort attempt to conform the flow to the change. If the flow cannot be successfully “diverted” to this new policy, then an Alert asks if you want to reset.

  • Selected flows are individually selected; All Returned results from filtering (up to the max number of returnable flows); and All refers to all flows, visible or not.

Export

Click Export to save the contents of the Flows table to a CSV file.

Flow Detail

Click the info icon in the Detail column to display information about the flow. This information is primarily provided to assist Support with troubleshooting and debugging.

Inbound/Outbound Reduction %

The Inbound Reduction % and Outbound Reduction % columns in the Flows table refer to reduced WAN traffic relative to a specific appliance.

• Reduction % for outbound traffic = 100(Received from LAN – Transmitted to WAN)/Received from LAN

• Reduction % for inbound traffic = 100(Transmitted to LAN – Received from WAN)/Transmitted to LAN

NOTE: These columns are hidden in the Flows table by default. To display them, right-click any column header in the table to display a list of available columns, and then select the Inbound Reduction % and Outbound Reduction % check boxes.

Additional Information about Flows

Note the following version specific and general information about flows:

ECOS 9.1 Behavior Changes

All flows in drop state are reset at flow reclassify time, overriding intervals described below.

ICMP/UDP Flows

• For any non-TCP connection (such as icmp, UDP), a flow is deleted only from inactivity.

• The inactivity timeout is three minutes for this type of flow. For example, after a ping connection is stopped, the flow still appears in the “Current Flows” for three minutes. This setting can be modified by using the system template.

TCP Non Accelerated Flows

• For a TCP connection, a flow is deleted under different timeouts. A half-open (single SYN) connection stays for two minutes if the connection does not establish correctly. A half-close (single FIN) or unclean-close (RST) deletes the connection after two minutes. A normal close (FIN-FIN) deletes the connection almost immediately.

• A TCP connection also has an inactivity timeout. If no activity is detected on an established TCP connection for 30 minutes (by default), the flow is deleted. This setting can be modified by using the system template.

TCP Accelerated Flows

• Timeout is determined by the configured Keep Alive Timers.

  • A heartbeat ACK is sent to idle endpoints after ten minutes.

  • If the endpoints have closed, an RST is returned and the connection is deleted after two more minutes due to the unclean-close.

• The timers can be modified per sequence number by using the Optimization Template.

  • Idle Timeout: The period of time that a TCP connection has to be idle before a keep-alive is sent. (Default 600 seconds)

  • Probe Interval: The time in seconds between each keep-alive probe. (Default 30 seconds)

  • Probe Count: The number of times TCP probes the connection to determine whether it is alive after the keep-alive option has been activated. The connection is assumed to be lost after sending this number of keep-alive probes. (Default 8)

• Auto Reset Flows - Enables or disables the auto-reset of TCP flows. If a connection is seen by an appliance but after the handshake already completed, the connection would normally remain but without TCP Acceleration. If this feature is enabled, and a connection is reclassified in the Flows report, around 30 seconds later, it will be reset. When the endpoints re-establish the flow, it now will be subject to the optimization and route policies it matches. This feature is disabled by default. It can be enabled per sequence number by using the Optimization Template.

Outbound and Inbound

Outbound and Inbound in EdgeConnect refer to the direction of traffic as it flows from the LAN-side to the WAN-side of an appliance, or from the WAN-side to the LAN-side of an appliance. These are different from actual interface names, such as WAN0 or LAN0.

WAN optimization data reduction is calculated using the following formula:

Data Reduction % = (LAN Bytes - WAN Bytes) / LAN Bytes

---