Cflowd Overview
702 Router Configuration Guide
When a router receives a packet for which it currently does not have a flow entry, a flow
structure is initialized to maintain state information regarding that flow, such as the number
of bytes exchanged, IP addresses, port numbers, AS numbers, etc. Each subsequent packet
matching the same parameters of the flow contributes to the byte and packet count of the flow
until the flow is terminated and exported to a collector for storage.
For the 7450 ESS-7 and 7450 ESS-12, Cflowd is only supported if mixed mode is enabled.
Operation
Figure 30 depicts the basic operation of the cflowd feature. This sample flow is only used to
describe the basic steps that are performed. It is not intended to specify implementation.
Figure 30: Basic Cflowd Steps
1. As a packet ingresses a port, a decision is made to forward or drop the packet.
2. If the packet is forwarded, it is then decided if the packet should be sampled for
cflowd.
3. If a new flow is found, a new entry is added to the cache. If the flow already exists in
the cache, the flow statistics are updated.
copy of header sent to cflowd
HEADER
INFORMATION
PROCESSED
AND FLOW CACHE
UPDATED
INGRESS PORT
FORWARD/
DROP ?
SAMPLE?
FINISH FORWARDING
PROCESS AND SEND
TO EGRESS PORT
EGRESS PORT
drop
BIT BUCKET
NEW OR
EXISTING
FLOW
?
existing flow
new
flow
ADD ENTRY
FLOW CACHE
EXPORT
TO
COLLECTOR
UPDATE
ENTRY
To Next Page
Loading...
