Conversation

Objective & Definition

The objective of a conversation is to group a set of data exchanges between two hosts for a single application into one basic entity to be able to generate a more user-friendly report on network traffic.

A flow is a group of data exchanges between two hosts for one application over the aggregation period. A conversation is a group of flows over the observation period. The observation period is defined by a start time and an end time provided by the user. A conversation is defined by the following criteria:

• The device identifier that received the packets
• The VLAN tag that might be present in the packets
• Source or client IP address (please refer to the section Types of Conversations).
• Destination or server IP address
• Application (please refer to the article Application)

Types of Conversations

Cisco Provider Connectivity Assurance Sensors (formerly Skylight PVX) offer two ways to analyze network conversation. From a user’s perspective, network conversations can be seen in two different ways, which correspond to two different needs: Client/Server or Source/Destination. This chapter explains how those views differ, which kind of information they provide, and how they can be used.

Source / Destination

In a source/destination conversation, all flows between two hosts will be classified following the concepts of source and destination. This means that the flows will group data exchanges from a source IP address to a destination IP address regardless of whether they function as a client or a server.

For instance, a traffic from A to B for an application will be broken down into two conversations: a conversation from A to B and a conversation from B to A.

Src/Dst conversations correspond to a view of network flows for traffic analysis. When reviewing data for traffic analysis purposes, an administrator wants to view flows without considering the role of each host; that is to say, disregarding if the host is a client or a server.

Source/Destination treatment

For example, traffic from A to B takes into account all traffic coming from a host in A to a host in B, regardless of the role they played (client or server). The above graphs take into account the communications from A to B, only in one direction.

Client / Server

In a client/server conversation, all flows between two hosts will be classified following the concepts of client and server. This means that the flows will group data exchanges to (and from) a client IP address from (and to) a server IP address.

For instance, a traffic from A to B for an application (provided both A and B can be a server for a single application) will be broken down in two conversations: a conversation for client A & server B (with traffic from A to B and from B to A) and a conversation from client B to server A (with traffic from A to B and from B to A).

Clt/Srv corresponds to a view of network flows for performance analysis. When reviewing data for performance analysis purposes, an administrator wants to view flows in function of the role of each host, client or server. Indeed, the role of a host has an impact on the metrics displayed and the clients and servers cannot be mixed.

Client/Server treatment

For example, the clt/srv graphs shown above will be generated taking into account the communications:

• From clients in A to servers in B
• From servers in B to clients in A

In short, the traffic displayed in client/server conversations will take into consideration the data transfer in both directions.

Where are both being used?

Src/Dst will be used for all views of oriented traffic, i.e., where the reports need to show the amount of data from one zone to another zone. Hereunder (in the first and second lines of the table) you can see that the data exchange between the two hosts has been split into two conversations, from A to B and from B to A.

Source/Destination conversations

On the other hand, client/server conversations will be used for all views reporting performance. Hereunder you can see (in the first line of the table) that a client/server conversation takes into account the traffic in both directions.

Client/Server conversations

In general, you will find that:

• Client/Server is relevant when we are speaking about Performance;
• Source/Destination is relevant when we are speaking about Usage.

Top-Down Analysis

The Src/Dst matrix can be the starting point for a fine-tuning analysis of traffic: bandwidth and conversation. In each cell, there are two buttons:

• One to display the bandwidth graph from zone A to zone B
• One to display the conversations from zone A to zone B.

Cell detailed view

The first link will open the conversation table and will display all the traffic between the two zones, whereas the second one will display a bandwidth chart from the source zone on the left and the destination zone on the top.