Flows - Active and Recent
Monitoring > Bandwidth > Flows > Active & Recent Flows
Use the Flows tab to view, filter, and manage flows for all your appliances or the appliances you select in the appliance tree.
The following table describes the filters displayed in the top portion of the Flows tab.
|Application||Includes built-in applications, custom applications, and user-created application groups. Select the text field and a list displays. Choose the application you want to apply to your flow or enter the exact application you want to apply.|
|App Group||Includes the application group created by the user. Select the text field and a list displays. Choose the application group you want to apply to your flow or enter the exact application group you want to apply.|
|Role||Specify the user role you want to apply.|
|User Name||Specify the name of the user you want to apply.|
|IP/Subnet||This shows the flows that match both SRC IP and DEST IP as the two endpoints if SRC:DEST is enabled. If not enabled, all sources will appear when the filter is applied. You can apply this filter by clicking Enter without selecting the Apply button if you want to do so.|
|Port||This displays ports with SRC and DEST as the two endpoints if SRC: DEST is enabled. If not enabled, all ports will appear when the filter is applied.|
|Segment||Filters flows by the specified segment(s). Any will filter flows based on all segments as configured in routing segmentation. This filter is available only if routing segmentation is enabled. This filter works in conjunction with the Zone filter. For details, see the “Segment and Zone Filters” section below this table.|
|Zone||Filters flows by the specified firewall zone(s). Any will filter flows based on all firewall zones. This filter works in conjunction with the Segment filter. For details, see the “Segment and Zone Filters” section below this table.|
|VLAN||Identifies the Virtual Local Area Network of a packet. Enter the VLAN ID you want to apply to your flow in the text field. EdgeConnect supports up to 64 VLANs.|
|DSCP||Select the desired DSCP from the list. You can choose any or a specified DSCP from the list.|
|Protocol||You can specify the protocol you want to apply to your filter. Select the text field and a list displays. You can select all or specify an individual protocol to apply.|
|Domain||Includes the domain you can specify to filter your flow. Use the format *.domain.* or *.domain.[com, info, edu, org, net, and so forth.] Select the text field and a list displays. Choose the domain you want to apply.|
|Overlay||Overlay to which the flow is applied. Overlays are defined on the Business Intent Overlay tab.|
|Transport||Select any of the three transport types: SD-WAN, Breakout, and Underlay.
You can also apply a third-party service in this column if you have one configured.
|Flow Characteristics||You can apply any of the following flow characteristics to your flow: Boosted, Directly Attached, IPS Dropped, Pass-Through, Slow Devices, Route Dropped, Firewall Dropped, Embryonic, and Asymmetric.
NOTE: You can select only one flow characteristic at a time.
Slow Devices: For debugging. A slow device cannot receive data quickly enough from the EdgeConnect appliance. This causes the appliance to expend too many resources for this device at the expense of accelerating other devices. To counteract this, disable TCP acceleration for the slow devices in the Optimization Policy.
Embryonic: For TCP, this is a flow that is in a state of formation (for example, three-way handshake is not complete). For UDP, ICMP, and other IP protocols, this is a flow for one-way traffic. ICMP Error packets without request are also considered embryonic. Dropped embryonic flows are highlighted in red.
Other drops are also highlighted in red, including firewall policy drops, some system/routing drops, and IPS drops. For the Firewall Protection Profiles feature, some flows could drop because of security errors, such as not complying to strict three-way handshakes. These are highlighted in red as well.
|Include EdgeHA||If not selected, EdgeHA flows are excluded (default). If selected, the flows between EdgeHA will be included.|
|Include Built-in||Includes the built-in policy flows. If not selected, they are excluded (default). If selected, they will be included.|
|Active/Ended||Select to apply an active or ended flow as a filter. If selected, the Started and/or Ended fields become available.|
|Started/Ended||Select the started or ended time of the flow from the drop-down menu. If Custom is selected, use the provided fields to specify an exact date and time range. These fields are available only if Active or Ended are selected.|
|Duration||Shows flows that have lasted through a specific time frame. You can select < (less than) or > (greater than), and enter a specific duration (in minutes).|
|Bytes||You can specify whether you want to filter flows that have transferred their total bytes or within the last five minutes.|
|Filter||This list has all the saved filters. When selected, the filter configurations are loaded. See more information below about the Filter option.|
Segment and Zone Filters
The Segment and Zone fields in the top portion of the Flows tab work together to filter flows that display in the Flows table based on your segment and firewall zone selections. The Segment filter is available only if routing segmentation is enabled.
The following table details the various Segment and Zone filter settings. Keep in mind that for both segment and zone, either means that filtered flows will be either sourced from or destined to the selected segment or zone. For a Segment either condition, only one Segment field is displayed; for a Zone either condition, only one Zone field is displayed.
Click the Src <-> Dest icon () associated with the Segment filter to toggle between displaying only one Segment field (the either option) and displaying two fields (source on the left and destination on the right).
The From:To check box associated with the Zone filter functions similarly. Clear this check box to display only one Zone field (the either option). Select it to display the From and To fields.
|For a Segment either condition, if the Segment field is set to Any||the Zone fields are disabled regardless of whether you select the From:To check box|
|For a Segment either condition, if the Segment field is set to a specific segment||only one Zone field is enabled (the Zone either condition) and the drop-down menu lists zones associated with only the selected segment; the From and To fields are not available|
|If the Segment source and destination fields are both set to Any||the Zone drop-down fields are disabled regardless of whether you select the From:To check box|
|If the Segment source field is set to Any, but the Segment destination field is set to a specific segment||the Zone either condition does not apply; only the To field is available and the drop-down menu lists zones associated with only the selected segment|
|If the Segment source field is set to a specific segment, but the Segment destination field is set to Any||the Zone either condition does not apply; only the From field is available and the drop-down menu lists zones associated with only the selected segment|
|If the Segment source and destination fields are both set to specific segments||the Zone either condition does not apply; both the From and To fields are available and the drop-down menus list zones associated with only the selected segments|
|If routing segmentation is disabled in your network||the Segment filter is not displayed; the Zone fields are enabled, but zones that are associated with only the default segment are listed in the drop-down menus|
You can use the Filter field to configure specific filters. The drop-down menu displays a list of default filters you can apply to your flows. Click the edit icon to add, edit, or delete filters.
To add a filter:
Click the edit icon next to the Filter field.
Create a filter or select one from the list.
You can also select the history tab with the two arrows next to the Filter field if you want to go back to a previously applied filter. A maximum of 20 previously applied filters can be saved.
Reset or Reclassify Flows
You can Reclassify or Reset [Selected / All Returned / All] flows:
Resetting the flow kills it and restarts it. It is service-affecting.
Reclassifying the flow is not service-affecting. When policy changes occur, flow reclassification makes a best-effort attempt to conform the flow to the change. If the flow cannot be successfully “diverted” to this new policy, then an Alert asks if you want to reset.
Selected flows are individually selected; All Returned results from filtering (up to the max number of returnable flows); and All refers to all flows, visible or not.
Click Export to save the contents of the Flows table to a CSV file.
Click the info icon in the Detail column to display information about the flow. This information is primarily provided to assist Support with troubleshooting and debugging.
Inbound/Outbound Reduction %
The Inbound Reduction % and Outbound Reduction % columns in the Flows table refer to reduced WAN traffic relative to a specific appliance.
Reduction % for outbound traffic = 100(Received from LAN – Transmitted to WAN)/Received from LAN
Reduction % for inbound traffic = 100(Transmitted to LAN – Received from WAN)/Transmitted to LAN
NOTE: These columns are hidden in the Flows table by default. To display them, right-click any column header in the table to display a list of available columns, and then select the Inbound Reduction % and Outbound Reduction % check boxes.
Additional Information about Flows
Note the following version specific and general information about flows:
ECOS 9.1 Behavior Changes
All flows in drop state are reset at flow reclassify time, overriding intervals described below.
For any non-TCP connection (such as icmp, UDP), a flow is deleted only from inactivity.
The inactivity timeout is three minutes for this type of flow. For example, after a ping connection is stopped, the flow still appears in the “Current Flows” for three minutes. This setting can be modified by using the system template.
TCP Non Accelerated Flows
For a TCP connection, a flow is deleted under different timeouts. A half-open (single SYN) connection stays for two minutes if the connection does not establish correctly. A half-close (single FIN) or unclean-close (RST) deletes the connection after two minutes. A normal close (FIN-FIN) deletes the connection almost immediately.
A TCP connection also has an inactivity timeout. If no activity is detected on an established TCP connection for 30 minutes (by default), the flow is deleted. This setting can be modified by using the system template.
TCP Accelerated Flows
Timeout is determined by the configured Keep Alive Timers.
A heartbeat ACK is sent to idle endpoints after ten minutes.
If the endpoints have closed, an RST is returned and the connection is deleted after two more minutes due to the unclean-close.
The timers can be modified per sequence number by using the Optimization Template.
Idle Timeout: The period of time that a TCP connection has to be idle before a keep-alive is sent. (Default 600 seconds)
Probe Interval: The time in seconds between each keep-alive probe. (Default 30 seconds)
Probe Count: The number of times TCP probes the connection to determine whether it is alive after the keep-alive option has been activated. The connection is assumed to be lost after sending this number of keep-alive probes. (Default 8)
Auto Reset Flows - Enables or disables the auto-reset of TCP flows. If a connection is seen by an appliance but after the handshake already completed, the connection would normally remain but without TCP Acceleration. If this feature is enabled, and a connection is reclassified in the Flows report, around 30 seconds later, it will be reset. When the endpoints re-establish the flow, it now will be subject to the optimization and route policies it matches. This feature is disabled by default. It can be enabled per sequence number by using the Optimization Template.
Outbound and Inbound
Outbound and Inbound in Aruba EdgeConnect refer to the direction of traffic as it flows from the LAN-side to the WAN-side of an appliance, or from the WAN-side to the LAN-side of an appliance. These are different from actual interface names, such as WAN0 or LAN0.
|Description||Counter Type||Traffic Received On||Traffic Forwarded To|
|Inbound LAN||LAN TX||WAN-side interface||LAN-side interface|
|Outbound LAN||LAN RX||LAN-side interface||WAN-side interface|
|Inbound WAN||WAN RX||WAN-side interface||LAN-side interface|
|Outbound WAN||WAN TX||LAN-side interface||WAN-side interface|
WAN optimization data reduction is calculated using the following formula:
Data Reduction % = (LAN Bytes - WAN Bytes) / LAN Bytes