Why use flow-tools instead of cflowd?
- flow-capture preserves the sub-second portion of the NetFlow timestamps
that cflowd discards
- flow-tools is easier to build because it is written in portable C.
Problems with building cflowd may occur because it requires
cutting edge C++ features
- flow-tools is actively maintained, and supports
newer NetFlow versions, including those from the popular Cisco Cat6K
series platforms
Using flow-tools only required a small change to FlowScan, so a full
release was not done. Tips for configuring FlowScan to work with flow-tools can be found at:
http://net.doit.wisc.edu/~plonka/list/flowscan/archive/1117.html.
Does FlowScan still support cflowd?
FlowScan supports cflowd as long as Dave Plonka's
patch
is installed. Currently, a majority of FlowScan users choose cflowd.