netstream timeout inactive

When network flows burst within a short period of time, tens of thousands of flows may be generated within several seconds, and these flows are saved in the buffer on the NDE. The memory capacity of the NDE, however, is limited. When subsequent flows need to be added to the buffer, flows that have been processed in the buffer need to be deleted. This process is called aging. Aged flows are sent to the specified NSC for further analysis.

The aging frequency is determined by the storage space of the device and flow size. The greater the flow size is, the smaller the aging time should be.

When the inactive time (from the last packet receiving time to the current time) of a flow exceeds the specified inactive aging time, the flow is exported to the destination end. The inactive aging time determines when an inactive flow will be aged to release occupied resources. When the traffic rate is high, shorten the inactive time to accelerate traffic aging and improve statistics collecting efficiency.

A flow is aged in any of the following situations:

• Time-based aging: A flow is aged after the configured inactive time elapses. if the inactive time of a flow in the buffer elapses, the system ages the flow immediately, regardless of whether the active aging time of the flow elapses. You can set the inactive aging time or use the default values.
• TCP disconnection-based aging: After a packet carrying the FIN or RST flag is transmitted over a TCP connection, the TCP connection is torn down. Therefore, when a NetStream flow consisting of TCP packets receives a packet carrying the FIN or RST flag, the NetStream flow is immediately aged. If the first packet of a NetStream flow is a TCP packet carrying the FIN or RST flag, a new NetStream flow is created. In addition, the original NetStream flow is not aged.
• Byte counts-based aging: Bytes of flows cached in the buffer are counted. If the flow bytes in a buffer exceed the upper threshold, the buffer overflows. For example, if the number of bytes in a flow is greater than 3435973836 B, the system immediately ages the flow.