A flow is generically dened by an optional pattern (which denes which packets we will focus on) and an identier (val- ues for a set of specied header elds). We can also general- ize by allowing the identier to be a function of the header eld values (., using prexes instead of addresses based on a mapping using route tables). Flow denitions vary with applications: for example for a tra c matrix one could use a wildcard pattern and identiers dened by distinct source and destination network numbers. On the other hand, for identifying TCP denial of service attacks one could use a pattern that focuses on TCP packets and use.
