Cflowd
Router Configuration Guide 703
4. If a new flow is detected and the maximum number of entries are already in the flow
cache, the earliest expiry entry is removed. The earliest expiry entry/flow is the next
flow that will expire due to the active or inactive timer expiration.
5. If a flow has been inactive for a period of time equal to or greater then the inactive
timer (default 15 seconds), then the entry is removed from the flow cache.
6. If a flow has been active for a period of time equal to or greater than the active timer
(default 30 minutes), then the entry is removed from the flow cache.
When a flow is exported from the cache, the collected data is sent to an external collector
which maintains an accumulation of historical data flows that network operators can use to
analyze traffic patterns.
Data is exported in one of the following formats:
• Version 5 — Generates a fixed export record for each individual flow captured.
• Version 8 — Aggregates multiple individual flows into a fixed aggregate record.
• Version 9 — Generates a variable export record, depending on user configuration
and sampled traffic type (IPv4, IPv6, or MPLS), for each individual flow captured.
• Version 10 (IPFIX) — Generates a variable export record, depending on user
configuration and sampled traffic type (IPv4, IPv6, or MPLS), for each individual
flow captured.
Figure 31 depicts Version 5, Version 8, Version 9, and Version 10 flow processing.
Figure 31: V5, V8, V9, V10, and Flow Processing
DATA AGED
FROM ACTIVE
FLOW CACHE
V5/V8/V9/V10
FORMAT
V8
v5/v9/v10
FORMAT AND
SEND V5 RECORD
TO EXTERNAL
COLLECTOR
ADD ENTRY
V8 AGGREGATE
FLOW CACHE
V8 AGGREGATE
FLOW CACHE
V8 AGGREGATE
FLOW CACHE
AGE AGGREGATE
FLOWS
FORMAT AND
SEND V8 RECORD
TO EXTERNAL
COLLECTOR
To Next Page
Loading...
