cflowd configuration: Overview

Next Previous Contents

## 1. Overview

## 1.1 Data flow

It is useful to understand the flow of data in the `cflowd` system before configuration. Figure 1 is a diagram showing a high-level view of the flow of data in the cflowd system.

Figure 1: cflowd data flow

Each Cisco router sends flow-export packets (version 1, version 5 or version 8) to a host running `cflowdmux` and `cflowd`. `cflowd` creates tabular data from the data in the flow-export packets. `cflowd` also serves the tabular data to `cfdcollect`. `cfdcollect` will contact each configured instance of `cflowd` at regular intervals (configurable) to retrieve tabular data, and will store the data in ARTS files.

A typical configuration inside a provider network would have several workstations in the network running `cflowd`, each located in close proximity to the routers from which they're receiving flow-export data. A single instance of `cfdcollect` would be run on a centrally located server with plenty of disk space.

It should be noted that `cflowd` does not receive flow-export packets directly. A program called `cflowdmux` is responsible for handling UDP packets from the Cisco routers, and will put the packets in shared memory buffers which can be read by `cflowd`. In addition, `cflowd` acts a server to local table clients like `cfdases`, as well as acting as the server for `cfdcollect`. A more detailed diagram showing the data flow in the system is seen in Figure 2.

Figure 2: cflowd data flow detail

Next Previous Contents