NetStream traffic on the network bursts intermittently. Tens of thousands of flows are generated in a few seconds. As the NDE memory capacity is limited, flows that are saved on the NDE earlier must be exported rapidly to release space. This process is called aging.
A flow is aged in any of the following situations:
Regular aging
A flow is aged after its inactive time (from the time no packets are added to the flow to the current time) or its active time (from the time the flow is constructed to the current time) elapses. After the active time elapses, the system does not age the flow in the buffer until a new flow enters the buffer. After the inactive time elapses, the system immediately ages the flow, regardless of whether the flow is within the active time.
The active time is used to periodically export the long-lasting flow.
The inactive time is used to export the flow to which packets are intermittently added. Once packets stop being added to the flow, the flow is exported to release memory space.
FIN-based or RST-based aging
A flow is aged when the FIN or RST bit in a packet of a flow is detected. This is because the FIN or RST bit in the packet transmitted over a TCP connection indicates that the TCP connection is terminated. If a packet containing the FIN or RST bit is added to a flow, the system immediately ages the flow.
By default, the system ages a flow that contains a packet carrying the FIN or RST bit. To collect statistics about packets carrying TCP flags, disable the system from aging a flow that contains a packet carrying the FIN or RST bit.
Bytes-based aging
A flow is aged when the number of bytes exceeds the upper limit. Bytes of packets in the flows cached in the buffer are counted. The system therefore immediately ages the flow to avoid the byte counting error.
Forcible aging
You can configure the device to forcibly age all original flows in the existing buffer. Forcible aging is used when the aging conditions are not met but new flows need to be added to the buffer or when the NetStream service becomes abnormal, causing flows in the buffer not to be aged.