Citrix Systems Network Router NETSCALER 9.3 User Manual download pdf (Page 169)

To help the collector link all four flows in a transaction, AppFlow adds a custom

transactionID element to each flow. For application-level content switching, such as

HTTP, it is possible for a single client TCP connection to be load balanced to different

backend TCP connections for each request. AppFlow provides a set of records for each

transaction.

Flow Records

AppFlow records contain standard NetFlow or IPFIX information, such as time stamps

for the beginning and end of a flow, packet count, and byte count. AppFlow records

also contain application-level information (such as HTTP URLs, HTTP request methods

and response status codes, server response time, and latency) IPFIX flow records are

based on templates that need to be sent before sending flow records.

Templates

AppFlow defines a set of templates, one for each type of flow. Each template contains

a set of standard Information Elements (IEs) and Enterprise-specific Information

Elements (EIEs). IPFIX templates define the order and sizes of the Information Elements

(IE) in the flow record. The templates are sent to the collectors at regular intervals, as

described in RFC 5101.

A template can include the following EIEs:

transactionID

An unsigned 32-bit number identifying an application-level transaction. For HTTP,

this corresponds to a request and response pair. All flow records that correspond to

this request and response pair have the same transaction ID. In the most common

case, there are four uniflow records that correspond to this transaction. If the

NetScaler generates the response by itself (served from the integrated cache or by a

security policy), there may be only two flow records for this transaction.

connectionID

An unsigned 32-bit number identifying a layer-4 connection (TCP or UDP). The

NetScaler flows are usually bidirectional, with two separate flow records for each

direction of the flow. This information element can be used to link the two flows.

For the NetScaler, connectionID is an identifier for the connection data structure to

track the progress of a connection. In an HTTP transaction, for instance, a given

connectionID may have multiple transactionID elements corresponding to multiple

requests that were made on that connection.

tcpRTT

The round trip time, in milliseconds, as measured on the TCP connection. This can be

used as a metric to determine the client or server latency on the network.

httpRequestMethod

An 8-bit number indicating the HTTP method used in the transaction. An options

template with the number-to-method mapping is sent along with the template.

Citrix NetScaler Administration Guide

169

1 2 ... 164 165 166 167 168 169 170 171 172 173 174 ... 194 195

No comments

Citrix Systems Network Router NETSCALER 9.3 User Manual Page 169