VERSION. 0.10.3
DESCRIPTION. pmacct is a small set of passive network monitoring tools to measure, account, classify and aggregate IPv4 and IPv6 traffic; a pluggable and flexible architecture allows to store the collected traffic data into memory tables or SQL (MySQL, SQLite, PostgreSQL) databases. pmacct supports fully customizable historical data breakdown, flow sampling, filtering and tagging, recovery actions, and triggers. Libpcap, sFlow v2/v4/v5 and NetFlow v1/v5/v7/v8/v9 are supported, both unicast and multicast. Also, a client program makes it easy to export data to tools like RRDtool, GNUPlot, Net-SNMP, MRTG, and Cacti. HOMEPAGE. http://www.pmacct.net/ DOWNLOAD. SUSE Linux Enterprise Server 9 ftp://ftp.suntel.com.tr/pub/repo/monitoring/SLES_9/ SUSE Linux 9.3 ftp://ftp.suntel.com.tr/pub/repo/monitoring/SUSE_Linux_9.3/ SUSE Linux 10.0 ftp://ftp.suntel.com.tr/pub/repo/monitoring/SUSE_Linux_10.0/ SUSE Linux 10.1 ftp://ftp.suntel.com.tr/pub/repo/monitoring/SUSE_Linux_10.1/ Mandriva 2006 ftp://ftp.suntel.com.tr/pub/repo/monitoring/Mandriva_2006/ Fedora 4 ftp://ftp.suntel.com.tr/pub/repo/monitoring/Fedora_Core_4/ Fedora 5 ftp://ftp.suntel.com.tr/pub/repo/monitoring/Fedora_Core_5/ CHANGELOG. + New Pre-Tagging key 'label': mark the rule with label's value. Labels don't need to be unique: when jumping, the first matching label wins. + New Pre-Tagging key 'jeq': Jump on EQual. Jumps to the supplied label in case of rule match. Before jumping, the tagged flow is returned to active plugins, as it happens for any regular match (set return=false to change this). In case of multiple matches for a single flow, plugins showing 'tag' key inside 'aggregate' directive will receive each tagged copy; plugins not receiving tags will still receive unique copy of the flow. sFlow and NetFlow are usually uni-directional, ie. ingress-only or egress-only (to avoid duplicates). Meaningful application of JEQs is tagging flows two times: by incoming interface and by outgoing one. Only forward jumps are allowed. "next" is reserved label and causes to jump to the next rule. Many thanks to Aaron Glenn for brainstorming about this point. + New Pre-Tagging key 'return': if set to 'true' (which is default behaviour) returns the current packet/flow to active plugins, in case of match. If switched to 'false', it will prevent this to happen. It might be thought either as an extra filtering layer (bound to explicit Pre-Tagging rules) or (also in conjunction with 'stack') as a way to add flexibility to JEQs. + New Pre-Tagging key 'stack': actually '+' (ie. sum symbol) is the unique supported value. This key makes sense only if JEQs are in use. When matching, accumulate IDs, using the specified operator/ function. For example, usually <tag>=<currentID>. By setting 'stack=+' you will be able to get <tag>=<previousID + currentID>. ! Pre-Tagging table now supports a maximum of 384 rules. Because of the newly introduced flow alteration features, tables are no longer internally re-ordered. However, IPv4 and IPv6 stacks are still segregated each other. NOTES. Thanks to Paolo Lucente for such a great program! -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
pgp99ZLbE8ACi.pgp
Description: PGP signature
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
