The Flows tab of Scope contains the flow map, which lists currently active flows and their statistics in a table.
The flow map in Scope is a convenient way of observing the captured traffic overview or verifying that the packet filter is functioning as expected.
Flow map has a set of fixed columns. For more information on the columns and flow results in general, see Flow Results.
||The source address and port (if port number is available)|
||The source address and port, (if port number is available)|
||The protocol above the address layer|
||0 = new, 1 = persistent, 2 = old|
||The current throughput in the downlink (received direction)|
||The current throughput in the uplink (sent direction)|
||The age of the flow in seconds|
||The time passed in seconds since the last packet detected in this flow|
Each flow has a state, which can have one of three values:
- New - The flow is new and reported for the first time in the flow map
- Persistent - The flow is receiving packets or has been inactive less than the allowed inactivity time
- Old - The flow did not receive any more packets during the allowed inactivity period and will be removed the next time flow results arrive
The inactivity counts duration from the last received packet. If the flow is active, this number remains at or near zero. When inactivity begins to increase, the flow has either stopped or not receiving any more packets. Once it reaches the flow timeout, the flow is deemed ended and will be removed from the flow map.