Operation
Figure 29
describe the basic steps that are performed. It is not intended to specify implementation.
FORWARD/
INGRESS PORT
BIT BUCKET
1. As a packet ingresses a port, a decision is made to forward or drop the packet.
2. If the packet is forwarded, it is then decided if the packet should be sampled for
cflowd.
3. If a new flow is found, a new entry is added to the cache. If the flow already exists in
the cache, the flow statistics are updated.
4. If a new flow is detected and the maximum number of entries are already in the flow
cache, the earliest expiry entry is removed. The earliest expiry entry/flow is the next
flow that will expire due to the active or inactive timer expiration.
5. If a flow has been inactive for a period of time equal to or greater than the inactive
timer (default 15 sec.), then, depending on the format, if V5, the entry is removed from
the flow cache, or, if V8, further processing occurs.
6. If a flow has bee active for a period of time equal to or greater than the active timer
(default 30 min.), then depending on the format, if V5, the entry is removed from the
flow cache, or, if V8, further processing occurs.
7750 SR OS Router Configuration Guide
depicts the basic operation of the cflowd feature. This sample flow is only used to
SAMPLE?
DROP ?
copy of header sent to cflowd
drop
HEADER
INFORMATION
PROCESSED
AND FLOW CACHE
UPDATED
Figure 29: Basic Cflowd Steps
FINISH FORWARDING
PROCESS AND SEND
TO EGRESS PORT
NEW OR
new
EXISTING
flow
FLOW
?
existing flow
UPDATE
ENTRY
Cflowd
EGRESS PORT
ADD ENTRY
EXPORT
FLOW CACHE
TO
COLLECTOR
Page 431