Cflowd Overview
704 Router Configuration Guide
1. As flows are expired from the active flow cache, the export format must be
determined, either Version 5, Version 8, Version 9, and Version 10.
→ If the export format is Version 5 or Version 9 and Version 10, no further
processing is performed and the flow data is accumulated to be sent to the
external collector.
→ If the export format is Version 8, then the flow entry is added to one or more of
the configured aggregation matrices.
→ As the entries within the aggregate matrices are aged out, they are accumulated
to be sent to the external flow collector in Version 8 format.
The sample rate and cache size are configurable values. The cache size default is 64K flow
entries.
A flow terminates when one of the following conditions is met:
• When the inactive timeout period expires (default: 15 seconds). A flow is considered
terminated when no packets are seen for the flow for N seconds.
• When an active timeout expires (default: 30 seconds). Default active timeout is 30
minutes. A flow terminates according to the time duration regardless of whether or
not there are packets coming in for the flow.
• When the user executes a clear cflowd command.
• When other measures are met that apply to aggressively age flows as the cache
becomes too full (such as overflow percent).
Version 8
There are several different aggregate flow types including:
• AS matrix
• Destination prefix matrix
• Source prefix matrix
• Prefix matrix
• Protocol/port matrix.
Version 8 is an aggregated export format. As individual flows are aged out of the raw flow
cache, the data is added to the aggregate flow cache for each configured aggregate type. Each
of these aggregate flows are also aged in a manner similar to the method the active flow cache
entries are aged. When an aggregate flow is aged out, it is sent to the external collector in the
Version 8 record format.
To Next Page
Loading...
