Next Previous Contents

1. Overview

1.1 Data flow

It is useful to understand the flow of data in the cflowd system before configuration. Figure 1 is a diagram showing a high-level view of the flow of data in the cflowd system.

Figure 1: cflowd data flow

Each Cisco router sends flow-export packets (version 1, version 5 or version 8) to a host running cflowdmux and cflowd. cflowd creates tabular data from the data in the flow-export packets. cflowd also serves the tabular data to cfdcollect. cfdcollect will contact each configured instance of cflowd at regular intervals (configurable) to retrieve tabular data, and will store the data in ARTS files.

A typical configuration inside a provider network would have several workstations in the network running cflowd, each located in close proximity to the routers from which they're receiving flow-export data. A single instance of cfdcollect would be run on a centrally located server with plenty of disk space.

It should be noted that cflowd does not receive flow-export packets directly. A program called cflowdmux is responsible for handling UDP packets from the Cisco routers, and will put the packets in shared memory buffers which can be read by cflowd. In addition, cflowd acts a server to local table clients like cfdases, as well as acting as the server for cfdcollect. A more detailed diagram showing the data flow in the system is seen in Figure 2.

Figure 2: cflowd data flow detail

Next Previous Contents