1. Overview
1.1 Data flow
It is useful to understand the flow of data in the cflowd
system before configuration. Figure 1 is a diagram showing a
high-level view of the flow of data in the cflowd system.
Each Cisco router sends flow-export packets (version 1, version 5 or
version 8) to a host running cflowdmux
and cflowd
.
cflowd
creates tabular data from the data in the flow-export
packets. cflowd
also serves the tabular data to
cfdcollect
. cfdcollect
will contact each configured
instance of cflowd
at regular intervals (configurable) to
retrieve tabular data, and will store the data in ARTS files.
A typical configuration inside a provider network would have several
workstations in the network running cflowd
, each located in
close proximity to the routers from which they're receiving flow-export
data. A single instance of cfdcollect
would be run on a
centrally located server with plenty of disk space.
It should be noted that cflowd
does not receive flow-export
packets directly. A program called cflowdmux
is responsible
for handling UDP packets from the Cisco routers, and will put the
packets in shared memory buffers which can be read by cflowd
.
In addition, cflowd
acts a server to local table clients like
cfdases
, as well as acting as the server for
cfdcollect
. A more detailed diagram showing the data flow in
the system is seen in Figure 2.
Next Previous Contents