VERSION.
0.9.2
DESCRIPTION.
pmacct is a small set of passive network monitoring tools to measure,
account and aggregate IPv4 and IPv6 traffic; aggregation revolves around
the key concept of primitives (VLAN id, source and destination MAC
addresses, hosts, networks, ports, AS numbers, IP protocol and ToS/DSCP
field are supported) which may be arbitrarily combined to build custom
aggregation methods; support for historical data breakdown, triggers and
packet tagging, filtering, sampling. Aggregates can be stored into
memory tables, SQL databases (MySQL or PostgreSQL) or simply pushed to
stdout. Data is collected from the network either using libpcap (and
optionally promiscuous mode)or reading Netflow v1/v5/v7/v8/v9 and sFlow
v2/v4/v5 datagrams.
HOMEPAGE.
http://www.ba.cnr.it/~paolo/pmacct/
CHANGELOG.
+ A new 'usrf' keyword is now supported into the 'sql_preprocess' tier:
it allows to apply a generic uniform renormalization factor to counters.
Its use is particularly suitable for use in conjunction with uniform
sampling methods (for example simple random - e.g. sFlow, 'sampling_rate'
directive or simple systematic - e.g. sampled NetFlow by Cisco and Juniper).
+ A new 'adjb' keyword is now supported into the 'sql_preprocess' tier: it
allows to add (or subtract in case of negative value) 'adjb' bytes to the
bytes counter. This comes useful when fixed lower (link, llc, etc.) layer
sizes need to be included into the bytes counter (as explained by the Q7
in the updated FAQS document).
+ A new '--enable-64bit' configuration switch allows to compile the package
with byte/packet/flow counters of 64bit (instead of the usual 32bit ones).
! The sampling algorithm endorsed by the 'sampling_rate' feature has been
enhanced to a simple randomic one (it was a simple systematic).
! Some static memory structures are now declared as constants allowing to
save memory space (given the multi-process architecture) and offering an
overral better efficiency. The patch is courtesy of Andreas Mohr. Thanks.
! Some noisy compiler warnings have been troubleshooted along with some
minor code cleanups; the contribution is from Jamie Wilkinson. Thanks.
! Some unaligned pointer issues have been solved.
NOTES.
None.
Cheers,
Paolo
