Filter
Top Products
Cflowd Overview
Page 432 7750 SR OS Router Configuration Guide
When a flow is exported from the cache, the collected data is sent to an external collector which
maintains an accumulation of historical data flows that network operators can use to analyze traffic
patterns.
Data is exported in one of two formats:
• Version 5 (V5) — V5 generates an export record for each individual flow captured.
• Version 8 (V8) — V8 aggregates multiple individual flows into an aggregate flow.
There are several different aggregate flow types including:
•AS matrix
• Destination prefix matrix
• Source prefix matrix
• Prefix matrix
• Protocol/port matrix.
V8 is an aggregated export format. As individual flows are aged out of the active flow cache, the
data is added to the aggregate flow cache for each configured aggregate type. Each of these
aggregate flows are also aged in a manner similar to the method the active flow cache entries are
aged. When an individual aggregate flow is aged out, it is sent to the external collector in the V8
record format.
Cflowd Filter Matching
In the filter-matching process, normally, every packet is matched against filter (access list) criteria
to determine acceptability. With cflowd, only the first packet of a flow is checked. If the first
packet is forwarded, an entry is added to the cflowd cache. Subsequent packets in the same flow
are then forwarded without needing to be matched against the complete set of filters. Specific
performance varies depending on the number and complexity of the filters.