Cflowd
7750 SR OS Router Configuration Guide Page 433
Figure 30 depicts V5 and V8 flow processing.
Figure 30: V5 and V8 Flow Processing
1. As flows are exported from the active flow cache, the export format must be determined, either
V5 or V8.
2. If the export format is V5, no further processing is performed and the flow data is accumulated to be sent to the external collector.3. If the export format is V8, then the flow entry is added to one or more of the config-ured aggregation matrices. Cflowd only records and sends flows that match the speci-fied criteria.
As the entries within the aggregate matrices are aged out, they are accumulated to be sent
to the external flow collector in V8 format.
The sample rate and cache size are configurable values. The cache size default is 64K flow entries.
If a flow is not updated in the time configured (the default is 15 seconds) that flow is aged out of
the cache and accumulated to be exported to the collector (that is, a server collecting cflowd data).
A flow terminates when one of the following conditions is met:
• When the inactive timeout period expires. A flow is considered terminated when no
packets are seen for the flow for N seconds.
• When an active timeout expires. A flow terminates according to the time duration
regardless of whether or not there are packets coming in for the flow.
• When the cflowd cache is cleared.
• When other measures are met that apply to aggressively age flows as the cache becomes
too full (i.e., overflow percent).
DATA AGED
FROM ACTIVE
FLOW CACHE
V5 OR V8
FORMAT
V8
V5
FORMAT AND
SEND V5 RECORD
TO EXTERNAL
COLLECTOR
ADD ENTRY
V8 AGGREGATE
FLOW CACHE
V8 AGGREGATE
FLOW CACHE
V8 AGGREGATE
FLOW CACHE
AGE AGGREGATE
FLOWS
FORMAT AND
SEND V8 RECORD
TO EXTERNAL
COLLECTOR