Understanding ESQM

Figure 1 illustrates an ESQM-capable device performing ESQM for inbound and outbound TCP, SCTP, or GTP packets on interfaces. The device determines a unique flow based on the packet quintuple information and sampling direction, and generates flow tables for storing collected information.

The device collects statistics on the numbers of packets forwarded and retransmitted after creating a flow table for a TCP flow. When the flow table's aging time arrives, the device reports the flow table information to the Huawei NCE through the telemetry channel.
The device collects statistics on the numbers of packets forwarded and retransmitted after creating a flow table for an SCTP flow. When the flow table's aging time is reached or the device receives an SCTP SHUTDOWN, SCTP SHUTDOWN ACK, or SCTP ABORT packet, the device reports the flow table information to the Huawei NCE through the telemetry channel.
The device collects statistics on the numbers of packets and bytes forwarded after creating a flow table for a GTP flow. After receiving a GTP heartbeat packet, the device reports the flow table information to the Huawei NCE through the telemetry channel.

Figure 1 Typical ESQM networking

Table 1 and Table 2 describe the fields contained in the flow tables for TCP/SCTP packets and GTP packets, respectively.

An example of the format of an output TCP/SCTP packet:

{"tcp-datas":{"tcp-data":[{"src-ip-addr":"10.1.1.1","dst-ip-addr":"10.1.1.2","src-port":1023,"dst-port":1023,"protocol":6,"age-type":"AgeType_AGINGX_TIME","flow-type":"FlowType_TCPX_SYN","flow-direction":"FlowDirection_INGRESS","port-if-index":47,"route-if-index":14,"next-hop":"10.1.1.2","label":0,"vpn-name":"_public_","created-timestamp-sec":1563469476,"created-timestamp-nano-sec":796319000,"packet-num":"1","retrans-num":"1","retrans-radio":"10000000","address-family":"AddressFamily_IPV4"}]}}

**Table 1** Fields contained in the flow table for TCP/SCTP packets
Field	Data Type	Description
src-ip-addr	String	Source IP address.
dst-ip-addr	String	Destination IP address.
src-port	UShort (2 bytes)	Source port number.
dst-Port	UShort (2 bytes)	Destination port number.
protocol	UCHAR (1 byte)	Protocol type.
age-type	Enumerated	Flow table aging type: 1: periodic aging 2: aging triggered by a TCP FIN packet (not supported) 3: aging triggered by a TCP RST packet (not supported) 4: aging triggered by an SCTP SHUTDOWN packet 5: aging triggered by an SCTP SHUTDOWN ACK packet 6: aging triggered by an SCTP ABORT packet
flow-type	Enumerated	Type of a flow: 1: TCP SYN 2: TCP SYN ACK 3: SCTP SACK 4: SCTP INIT 5: SCTP INIT ACK
flow-direction	Enumerated	Flow direction: 0: inbound 1: outbound
port-if-index	UInt32 (4 bytes)	Index of a sampling port, which must be a main physical port.
route-if-index	UInt32 (4 bytes)	Index of a routing interface: For inbound sampling, the index is of an outbound interface. For outbound sampling, the index is of an inbound interface.
next-hop	String	Next-hop IP address.
label	UInt32 (4 bytes)	Label.
vpn-name	String	VPN instance name.
created-timestamp-sec	UInt32 (4 bytes)	Second part of the timestamp for creating a flow table, which is the number of seconds since 1970.
created-timestamp-nano-sec	UInt32 (4 bytes)	Nanosecond part of the timestamp for creating a flow table.
packet-num	UInt64 (8 bytes)	Number of forwarded packets.
retrans-num	UInt64 (8 bytes)	Number of retransmitted packets.
retrans-radio	UInt64 (8 bytes)	Retransmission ratio, which is the ratio of retrans-num to packet-num. The ratio is accurate to the nearest 1/10000000. The device amplifies the retransmission ratio by a factor of 10000000 before transmitting it to NCE.
address-family	String	IP version number.

An example of the format of an output GTP packet:

{"gtp-datas":{"gtp-data":[{"src-ip-addr":"10.1.1.1","dst-ip-addr":"10.1.1.2","src-port":2152,"dst-port":2152,"protocol":17,"age-type":"AgeType_AGINGX_TIME","flow-type":"FlowType_GTP","flow-direction":"FlowDirection_INGRESS","port-if-index":47,"route-if-index":14,"next-hop":"10.1.1.2","label":0,"vpn-name":"_public_","heartbeat-time-sec":1563476027,"heartbeat-time-nano-sec":331645687,"packet-num":"1001","packet-bytes":"128128","packet-type":"PacketType_HEARTBEATX_RSQ","address-family":"AddressFamily_IPV4","last-ip-id":1,"curr-ip-id":2}]}}

**Table 2** Fields contained in the flow table for GTP packets
Field	Data Type	Description
src-ip-addr	String	Source IP address.
dst-ip-addr	String	Destination IP address.
src-port	UShort (2 bytes)	Source port number.
dst-port	UShort (2 bytes)	Destination port number.
protocol	UCHAR (1 byte)	Protocol type.
age-type	Enumerated	Flow table aging type: 1: periodic aging
flow-type	Enumerated	Type of a flow: 6: GTP
flow-direction	Enumerated	Flow direction: 0: inbound 1: outbound
port-if-index	UInt32 (4 bytes)	Index of a sampling port, which must be a main physical port.
route-if-index	UInt32 (4 bytes)	Index of a routing interface.
next-hop	String	Next-hop IP address.
label	UInt32 (4 bytes)	Label.
vpn-name	String	VPN instance name.
heartbeat-time-sec	UInt32 (4 bytes)	Second part of the timestamp for heartbeat packets, which is the number of seconds since 1970.
heartbeat-time-nano-sec	UInt32 (4 bytes)	Nanosecond part of the timestamp for heartbeat packets.
packet-num	UInt64 (8 bytes)	Number of forwarded packets.
packet-bytes	UInt64 (8 bytes)	Number of forwarded packet bytes.
packet-type	UCHAR (1 byte)	GTP heartbeat packet type: 0: GTP heartbeat packet 1: GTP heartbeat response packet
addressFamily	String	IP version number.
last-ip-id	UShort (2 bytes)	ID in the IPv4 header of the last packet.
curr-ip-id	UShort (2 bytes)	ID in the IPv4 header of the current packet.

The P node in the current version does not support ESQM.