It is useful to understand the flow of data in the cflowd
system before configuration. Figure 1 is a diagram showing a
high-level view of the flow of data in the cflowd system.
Each Cisco router sends flow-export packets (version 1, version 5 or
version 8) to a host running cflowdmux and cflowd.
cflowd creates tabular data from the data in the flow-export
packets. cflowd also serves the tabular data to
cfdcollect. cfdcollect will contact each configured
instance of cflowd at regular intervals (configurable) to
retrieve tabular data, and will store the data in ARTS files.
A typical configuration inside a provider network would have several
workstations in the network running cflowd, each located in
close proximity to the routers from which they're receiving flow-export
data. A single instance of cfdcollect would be run on a
centrally located server with plenty of disk space.
It should be noted that cflowd does not receive flow-export
packets directly. A program called cflowdmux is responsible
for handling UDP packets from the Cisco routers, and will put the
packets in shared memory buffers which can be read by cflowd.
In addition, cflowd acts a server to local table clients like
cfdases, as well as acting as the server for
cfdcollect. A more detailed diagram showing the data flow in
the system is seen in Figure 2.
