It is useful to understand the flow of data in the cflowd
system before configuration. Figure 1 is a diagram showing a
high-level view of the flow of data in the cflowd system.
Each Cisco router sends flow-export packets (version 1 or version 5) to
a host running cflowdmux
and cflowd
. cflowd
creates tabular data from the data in the flow-export packets.
cflowd
also serves the tabular data to cfdcollect
.
cfdcollect
will contact each configured instance of
cflowd
at regular intervals (configurable) to retrieve tabular
data, and will store the data in ARTS files.
A typical configuration inside a provider network would have several
workstations in the network running cflowd
, each located in
close proximity to the routers from which they're receiving flow-export
data. A single instance of cfdcollect
would be run on a
centrally located server with plenty of disk space.
It should be noted that cflowd
does not receive flow-export
packets directly. A program called cflowdmux
is responsible
for handling UDP packets from the Cisco routers, and will put the
packets in shared memory buffers which can be read by cflowd
.
In addition, cflowd
acts a server to local table clients like
cfdases
, as well as acting as the server for
cfdcollect
. A more detailed diagram showing the data flow in
the system is seen in Figure 2.