What is unidirectional flow?
A unidirectional flow records network traffic in a single direction, from source to destination.
Most flow export technologies, including NetFlow and IPFIX, generate separate flow records for each direction of a communication session. As a result, a typical client-server exchange usually produces two flow records: one describing traffic from the client to the server and another describing traffic from the server back to the client.
This directional approach preserves visibility into how traffic moves across the network and forms the foundation of many flow-monitoring systems.
How unidirectional flow works
Flow exporters observe packets as they traverse a network interface and create records based on traffic seen in a single direction.
When packets matching a common set of flow attributes are observed, the exporter creates a flow record describing that traffic. If return traffic is later observed, a separate flow record is generated with the source and destination information reversed.
For example:
| Direction | Flow record |
|---|---|
| Client → Server | Flow record 1 |
| Server → Client | Flow record 2 |
Together, these records represent the complete communication session.
This model is widely used because it scales efficiently and allows ingress and egress traffic to be measured independently.
Why unidirectional flows matter
Because each direction is recorded separately, unidirectional flows provide explicit visibility into how traffic moves between systems.
This makes it easier to understand upload and download behavior, measure directional bandwidth consumption, analyze inbound and outbound traffic independently, and investigate communication patterns across network boundaries.
Separate directional records are also useful when analyzing asymmetric traffic patterns where one direction carries significantly more traffic than the other, such as large downloads, streaming applications, backups, or certain types of attacks.
Unidirectional vs bidirectional flow
| Aspect | Unidirectional Flow | Bidirectional Flow |
|---|---|---|
| Records per conversation | Typically 2 | Typically 1 |
| Traffic directions | Separate records | Combined record |
| Directional analysis | Explicit | Embedded within conversation |
| Storage requirements | Higher | Lower |
| Conversation analysis | Requires correlation | Simplified |
Bidirectional flow records simplify conversation analysis by combining both directions into a single record. Unidirectional flow records preserve directional visibility but often require correlation when reconstructing complete conversations.
In Trisul
Unidirectional flow data is commonly used throughout Trisul Network Analytics.
Trisul ingests flow records from technologies such as NetFlow and IPFIX and uses them to provide visibility into traffic direction, communication behavior, and network activity. Flow-correlation capabilities allow operators to analyze complete conversations while preserving the directional detail present in the original flow records.
This approach is particularly useful for traffic investigations, capacity planning, ISP analytics, and environments where understanding ingress and egress behavior is important.
Related terms
- What is bidirectional flow?
- What is NetFlow?
- What is flow monitoring?
- What is traffic direction?
Frequently asked questions
What is unidirectional flow?
A unidirectional flow records network traffic in a single direction, from source to destination. Most flow export technologies, including NetFlow and IPFIX, generate separate flow records for each direction of a conversation.
How does unidirectional flow work?
A flow exporter creates a record for traffic observed in one direction. Traffic observed in the reverse direction generates a separate flow record. Together, these records represent the complete communication session.
What is the difference between unidirectional and bidirectional flow?
Unidirectional flow records each traffic direction separately, while bidirectional flow combines both directions into a single conversation record. Bidirectional records simplify conversation analysis, whereas unidirectional records preserve directional visibility.
Why are unidirectional flows important?
Unidirectional flows provide visibility into ingress and egress traffic independently, making them useful for traffic analysis, capacity planning, security monitoring, and directional traffic reporting.
Why do most flow exporters generate unidirectional records?
Generating records independently for each traffic direction is efficient, scalable, and provides explicit visibility into how traffic moves through the network.
What are the advantages of unidirectional flows?
Unidirectional flows make it easier to analyze traffic direction, measure upload and download activity separately, identify asymmetric communication patterns, and understand bandwidth usage across network boundaries.