In the most common deployment scenario, inbound traffic flows to a Virtual IP address (VIP) on the NetScaler appliance and is load balanced to a server. Outbound traffic flows from the server to a mapped or subnet IP address on the NetScaler and from the VIP to the client. A flow is a unidirectional collection of IP packets identified by the following five tuples: sourceIP, sourcePort, destIP, destPort, and protocol.
The following figure describes how the AppFlow feature works.
Figure 1. NetScaler Flow Sequence
As shown in the figure, the network flow identifiers for each leg of a transaction depend on the direction of the traffic.
The different flows that form a flow record are:
Flow1: <Client-IP, Client-Port, VIP-IP, VIP-port, Protocol>
Flow2: <NS-MIP/SNIP, NS-port, Server-IP, Server-Port, Protocol>
Flow3: <Server-IP, Server-Port, NS-MIP/SNIP, NS-Port, Protocol>
Flow4: <VIP-IP, VIP-port, Client-IP, Client-Port, Protocol>
To help the collector link all four flows in a transaction, AppFlow adds a custom transactionID element to each flow. For application-level content switching, such as HTTP, it is possible for a single client TCP connection to be load balanced to different backend TCP connections for each request. AppFlow provides a set of records for each transaction.
This topic includes the following details: