Traffic Tree Overview

PacketWise uses a hierarchical branching structure to organize and classify passing traffic, forming a traffic tree. The tree arranges traffic classes in parent, child, and sibling relationships, similar to folders and files in a standard file system. A traffic class identifies one type of traffic you want to manage together (an application, a protocol, all traffic to one location, and many other possibilities). A class can have one or more subordinate child classes with more specific characteristics than its parent class.

For example, the structure of a traffic tree fragment might look like this:

- Inbound
  + SAP
  + FTP
  - Citrix
    + PeopleSoft
    + MsWord
...and so on...

This tree fragment indicates that traffic is first organized by travel direction (Inbound), then by application (SAP, FTP, or Citrix), and then sometimes by further refinement of on application (PeopleSoft over Citrix, MS Word over Citrix). SAP, FTP, and Citrix are sibling classes and they are all share the same parent class — Inbound. When referencing a class, use a forward slash between each level, for example, /Inbound/Citrix/MsWord. You can create up to 11 levels in a traffic tree.

With this same tree fragment, FTP traffic that is traversing a link from a WAN to a LAN would be classified in Inbound/FTP. Traffic from a Microsoft Word application running over Citrix MetaFrame would be classified in the Inbound/Citrix/MsWord class.

The traffic tree is displayed when you click the manage or monitor tabs.

The tree is automatically sorted from most to least specific; classes with more specific criteria are at the top of the tree. For example, a web class for a specific URL would come before the general HTTP class. Classes that are the same relative level of specificity are alphabetized. PacketWise automatically determines the order of the classes in the tree and the only way you can change the order is to create an exception class.

Each traffic class has one or more matching rules that detail the criteria for determining which traffic matches the class. For each passing traffic flow, PacketWise traverses the traffic tree, starting at the top, to look for a matching traffic class. It compares each class' matching rules with the characteristics of the traffic flow. If they don't match, the search continues, going to the next class on the list (the next sibling). If they do match and the class has no child classes, the search stops. If the class has child classes, the search continues with the class' children.

Any traffic not explicitly classified in a specific traffic class is classified as /Inbound/Default or /Outbound/Default.

Creating a Traffic Tree

After you install your PacketShaper or reset the traffic tree, the factory-default tree includes six classes:

• /Inbound and /Outbound classes, with a Default class for each
• A Localhost (for traffic to the PacketShaper) class for the Inbound and Outbound directions

PacketWise can create a traffic tree for you, you can create your own, or you can do a combination of both. The location of your PacketShaper (at a main site or at a branch location) and your management goals (tracking traffic on a per-application, per-location, or other basis) influence which type of traffic tree is best for you. For a description of the types of traffic trees and their respective pros and cons, see Traffic Tree Designs. For more on how to create a traffic tree, see Classify Network Traffic.

The maximum number of classes in your traffic tree is determined by your Packeteer model. For example, the PacketShaper 1550 can have up to 256 classes. To look up the capacity of your model, see Configuration Limits.

Large Traffic Trees

If you have more than 2000 classes, there are several differences in traffic tree functionality:

• The manage tab does not display the traffic tree — you select the class you want to manage from a list.  show screen  
  
  
• The monitor tab does not display the entire traffic tree — it shows 100 classes at a time ( show screen), with next and previous links available for displaying other parts of the traffic tree.
  
  
• Traffic class icons (described in the next section) are not shown on the tree.

These differences in functionality are necessary when working with large traffic trees. You will notice a delay as the browser initially loads the traffic tree, particularly on WAN links. However, once the tree is loaded into memory, the delay as you display each 100-class list will be minimal.

Traffic Class Icons

Next to each class name in the traffic tree is an icon, or a combination of icons. The icons represent the basic properties of a traffic class, such as whether a policy or partition has been applied and whether the class is a standard, exception, or default class. The following table describes each of the traffic class icons.

Icon	Description
	Standard Traffic Class A class that has one or more matching rules and is not a match-all class (see "Match-All Class" below)
	Exception Traffic Class A class that has been tagged to sort above standard (non-exception) classes in the traffic tree. Exception classes give you the ability to redefine the search order that PacketWise uses to find a match for a traffic flow. See Create an Exception Class.
	Policy A class that has a policy associated with it
	Partition A class that has a partition associated with it
	Folder A class with no matching rules. The folder is used to organize the tree structure and serves as a container only. It doesn't match any traffic, and cannot have a policy applied to it. To create a folder class, see Create a Folder Class.
	Match-All Class A class that typically appears at the bottom of a subtree. The bucket catches any traffic flows not matched by its sibling classes in the subtree. A Default, match-all traffic class is created when the first child is added to a parent traffic class. For example, if you create a class for the Marketing subnet and then create a child class for a specific host on that subnet, a Default match-all class is created for the rest of the Marketing subnet. In this example, the default traffic class matches all traffic for the subnet (i.e., Protocol Family = any).

Icon Combinations

The traffic class icons can be combined together to designate a class with multiple characteristics. The following table provides examples of the icon combinations you might see on a traffic tree.

	Standard Traffic Class with a Policy A standard traffic class that has a policy assigned to it to control the quality of service for the traffic type.
	Exception Traffic Class with a Policy An exception traffic class that has a policy assigned to it. PacketWise automatically creates a Localhost class that is defined as an exception class with a priority policy set to a priority 6. This special class allows an administrator to always be able to access the unit in spite of congestion.
	Default Match-All Class with a Policy A match-all class, with the name Default, appears at the bottom of the /Inbound and /Outbound subtrees. These Default classes have inheritable policies. For details about inheritable policies, see Create an Inheritable Traffic Class.

HP PolicyXpert Class

HP PolicyXpert supports PacketWise by posting XML code to the PacketWise software to generate read-only classes at the top of the traffic class tree. These classes are placed near the Localhost class in the tree and take precedence over other classes and policies lower in the tree. For details, see the HP OpenView PolicyXpert Installation Guide.

See also:

Collapse and Expand the Traffic Tree

Classify Network Traffic

Traffic Tree Management Tasks