FlowScan - Flow Sources

FlowScan works with flow sources cflowd, flow-tools, argus, and the Lightweight Flow Accounting Protocol daemon lfapd.

Why use flow-tools instead of cflowd?

flow-capture preserves the sub-second portion of the NetFlow timestamps that cflowd discards
flow-tools is easier to build because it is written in portable C. Problems with building cflowd may occur because it requires cutting edge C++ features
flow-tools is actively maintained, and supports newer NetFlow versions, including those from the popular Cisco Cat6K series platforms

Using flow-tools only required a small change to FlowScan, so a full release was not done.

FlowScan supports cflowd as long as Dave Plonka's patch is installed. Currently, a majority of FlowScan users choose cflowd.

See https://catalog.caida.org/software/flowscan/ to explore related objects to this document in the CAIDA Resource Catalog.