In general, flows are a ``set of packets which share a common property.'' However, the most important such properties are the flow's endpoints. For example, the simplest type of flow is a 5-tuple, with all its packets having the same source and destination IP addresses and port numbers. Furthermore, 5-tuple flows are unidirectional, i.e.all their packets travel in the same direction. Such 5-tuple flows are commonly referred to as microflows.

Flows may have two endpoints, (TCP from host A to host B), or only one (all UDP flows from host C). Endpoints may also be more general, for example `TCP from network X/20 to network Y/24,' The above diagram shows the various types of flows arranged in terms of their endpoints. The dates given indicate the time each flow definition appeared.

A flow begins when a its first packet is observed, but one should state how to recognise the end of a flow. The most common method is to specify a fixed timeout, alternatively one can specify a dynamic timeout algorithm. On the diagram the timeout method is shown as F or D.

The flow types are:

	CPB		Claffy, Polyzos and Braun, 1994
	CoralReef		Supported by CAIDA's CoralReef analysis package
	NetFlow v5		Early versions of Cisco's NetFlow.  5-tuples with extra attributes such as AS number
	NetFlow v8		More recent version of NetFlow,  supports aggregation
	RTFM		Bi-directional, general flows. Endpoints defined in SRL RFC 2722
	NeTraMet stream		Bi-directional 5-tuples providing fine structure of RTFM flows. Brownlee and Murray, 2001