PacketShaper and Flow Directions

I stumbled across an old diagram I made a long time ago about the direction of flows on a BlueCoat PacketShaper. Since I’ve been looking for it for about three years, I’ve diagrammed it quickly so that it is here for future reference when I’m working PacketWise in the future. PacketShaper PacketWise is one of my very favourite tools for managing traffic flows, and much preferable to PHB QoS aka DiffServ for many types of use cases.

An TCP flow has four possible directional attribute related to the use of a inside and outside networks, and whether the flow was initiated from the client to server which sets the “direction” of the flow relative to the Packeteer. The flow is determined by who initiated the three way handshake. For purposes here, the Client always initiates the TCP connection, and the Server terminates the connection.

TCP Session and Direction

Most people understand the three way handshake, but not many consider the direction of the session.
Packet shaper flow directions 0

The connection from the client to the server is outbound, but is inbound on the server. And vice versa, the server outbound session is inbound on the client.

Packet shaper flow directions 0 1
That’s not very useful for being able to define the direction of flows.

Why is direction important ?

Direction of flows is important if you want to configure asymmetric rules. That is, not all protocols require symmetic bandwidth. For example, HTTP traffic is usually a 10:1 ratio for reply to request. That is, a request for this webpage is about 10KB, but the reply with the data, images and javascript is more than 100KB.

Packet shaper flow directions 0 2

For an FTP upload server, you might have the reverse condition where the inbound traffic is far more than the outbound.

To make the most of your Internet connection for this case, you could configure the inbound bandwidth on your Internet connection to be 80% FTP, 20% HTTP and the outbound bandwidth to be 20% FTP and 80% HTTP. This gives a far better utilisation, especially in regards to better TCP Windowing and overall TCP goodput.

Delete the X-Bluecoat-Via Header on your ProxySG

If you have noticed that your Blue Coat ProxySG inserts a HTTP header in every transaction, you might want to delete this to reduce information leakage to public networks

Loading Policy configuration in the Local file

A common question in the Blue Coat forums is “how do I load this config snippet into configuration. The question most often comes from people who are new to SGOS and have been using the Virtual Policy Manager. This quick note shows you how to load a config snippet that removes the X-Bluecoat-Via header

Subscribe For Weekly Updates by Email

Get a Weekly Summary of Latest Articles and Posts to your Email Inbox Every Sunday

Thanks for signing up. Look for the email from MailChimp & make sure you confirm your email address. You may need to check your spam or gmail settings to be sure of receiving the email.

Note: You can unsubscribe at any time using the link at the bottom of every email.