It is useful to understand the flow of data in the
system before configuration. Figure 1 is a diagram showing a
high-level view of the flow of data in the cflowd system.
Each Cisco router sends flow-export packets (version 1, version 5 or
version 8) to a host running
cflowd creates tabular data from the data in the flow-export
cflowd also serves the tabular data to
cfdcollect will contact each configured
cflowd at regular intervals (configurable) to
retrieve tabular data, and will store the data in ARTS files.
A typical configuration inside a provider network would have several
workstations in the network running
cflowd, each located in
close proximity to the routers from which they're receiving flow-export
data. A single instance of
cfdcollect would be run on a
centrally located server with plenty of disk space.
It should be noted that
cflowd does not receive flow-export
packets directly. A program called
cflowdmux is responsible
for handling UDP packets from the Cisco routers, and will put the
packets in shared memory buffers which can be read by
cflowd acts a server to local table clients like
cfdases, as well as acting as the server for
cfdcollect. A more detailed diagram showing the data flow in
the system is seen in Figure 2.