Home/ Questions/Q 7791549
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T21:55:14+00:00

I have a very large network trace file which contains both tcp and udp

  • 0

I have a very large network trace file which contains both tcp and udp packets.I want to find out the flows in the trace file.For that I have a hash function which takes in source ip address,destination ip address,source port,destination port and protocol.In case of TCP I can understand that the flow means all the packets which have the same 5 parameters same.But what does it mean in case of UDP.how does the concept of flow apply in case of UDP.? I am a novice in packet processing.And once I have idendified a flow (tcp and udp) how do I work out the direction of the flow.?Do I have to look at SYN flag ? If yes what do I do for UDP?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Netflow applies to any protocol including TCP and UDP. So to answer your question, yes, UDP packets should be treated the same as TCP.

    If you do Netflow processing you might find this spec useful – very detailed and for many versions. I can confirm that it is accurate and works fine with Cisco and Juniper devices (at least version 7)

    • 0