RTFM (RFCs 2720-2724) considers network traffic as being made up of bidirectional flows, which are ar bitrary groupings of packets defined only by attributes of their end-points. This paper extends RTFM's vi ew of traffic by adding two further concepts, streams and torrents. Streams are individual IP sessions (e.g. TCP or UDP) between ports on pairs of hosts, while a torrent refers to all traffic on a link.

We present stream measurement work using a meter located at UCSD (University of California, San Di ego) to measure response times for DNS requests to the global root and gTLD nameservers. This example sho ws how to configure NeTraMet to collect flow data for stream-based flow metrics, and demonstrates the use fulness of global DNS response plots for network operations.