Release Notes: Introduces custom-defined aggregation primitives in libpcap and ULOG daemons; enhances custom-defined aggregation primitives in NetFlow daemon to support variable-length fields. Introduces pro rating of NetFlow/IPFIX flows if historical accounting is enabled. Batching ofBGP sessions has also been introduced, preventing massive synchronization of resource consumption. New primitives mpls_top_label, mpls_bottom_label, and mpls_stack_depth have been implemented. The GTP tunnel handler now supports inspection of GTPv1 in the libpcap daemon. This release also includes a number of bugfixes.
Release Notes: Custom-defined aggregation primitives for NetFlow v9/IPFIX protocols are introduced. Pervasive JSON output and a new RabbitMQ plugin have also been added. Support for Cisco ASA NSEL was re-introduced. The set of MPLS aggregation primitives was broadened to better support L3 MPLS VPNs to include mpls_label_top, mpls_label_bottom, mpls_stack_depth, and mpls_vpn_rd. The Print plugin, which writes traffic stats to flat files, now supports creation of intermediate directory levels and appending. Support for MongoDB was improved with indexing and authentication. This release also includes a number of bugfixes.
Release Notes: The pmacct tee plugin now features a tee_receivers configuration directive to allow multiple receivers to be defined. Receivers can be grouped for load-balancing and filtering purposes, and the set of receivers can be reloaded at runtime. A new set of primitives have been introduced to support CGN (Carrier Grade NAT) scenarios via Cisco NEL (NetFlow Event Logging). The BGP daemon now supports IPv6 NLRI and IPv6 BGP next-hop elements for rfc4364 BGP/MPLS Virtual Private Networks. MongoDB plugin scalability has improved. Several bugfixes are also included in this release.
Release Notes: This release integrates an IS-IS daemon that is being run as a parallel thread within the collector core process; the project opens to MongoDB, a leading noSQL document-oriented database, via a new 'mongodb' plugin. Support for GeoIP lookups is being introduced: geoip_ipv4 and geoip_ipv6 config directives now allow loading Maxmind IPv4/IPv6 GeoIP database files. New sampling_rate and etype traffic aggregation primitives are added to the set. Support for samples generated on ACL matches in Brocade is also introduced. Several bugfixes are also included in this release.
Release Notes: This release integrates an IS-IS daemon, which is being run as a parallel thread within the collector core process. It implements a single L2 P2P neighborship, i.e. over a GRE tunnel, P2P Hello, CSNP, and PSNP, and does not send any LSP information out. A new aggregation primitive 'etype' is introduced in order to support accounting against the EtherType field of Ethernet frames. Support for samples generated on ACL matches in Brocade (sFlow sample type: Enterprise: #1991, Format: #1) is now also introduced. Several bugfixes are also included in this release.
Release Notes: The BGP daemon now features an implementation of BGP/MPLS VPNs (rfc4364): it correlates <router IP, input/output interfaces ifIndex)> couples to Route Distinguisher (RD) values. The print plugin can now write network traffic data to flat-files (print_output_file) featuring formatted or CSV output, dynamic filenames, historical breakdown, and triggers. pmacctd now supports the DLT_LOOP link-type (i.e. OpenBSD tunnel interfaces). Several enhancements to the uacctd daemon and other minor new features and miscellaneous fixes are included.
Release Notes: A sampling_map feature has been introduced, allowing definition of static traffic sampling mappings. Further work on the NetFlow v9/IPFIX sampling includes support for 16 bits SAMPLER_IDs (seen against IOS-XR) and support for (FLOW)_SAMPLING_INTERVAL fields as part of the NetFlow v9/IPFIX data record. [ns]facctd_as_new and [ns]facctd_net both feature a new "fallback" option to look up BGP-related primitives against BGP first and, if not successful, against the export protocol. Other minor new features and misc. fixes are also included in this release.
Release Notes: IPFIX (IETF IP Flow Information Export protocol) probe, replication, and collector capabilities have been introduced. Support for BerkeleyDB 5.x via the SQLite3 plugin has been added. It is now possible to get BGP-related traffic primitives (AS Path, local preference, communities, etc.) from a slow Extended Gateway object. Support has been introduced for NetFlow v9/IPFIX source and destination peer ASN field types 128 and 129. The pmacct client is now able to produce Comma-Separated Values (CSV) output in addition to formatted-text output, easing integration with 3rd party tools.
Release Notes: nfacctd, the pmacct NetFlow collector, has been enhanced to support NAT L3/L4 fields (IPFIX field types 225, 226, 227, 228, 281, and 282), Cisco ASA NetFlow v9 NSEL (field types 40001, 40002, 40003, 40004 152, 153, and 323) and application classification (aligning to Cisco NBAR-NetFlow v9 integration). The NetFlow probe plugin, nfprobe, introduces egress IPv4/IPv6 NetFlow v9 templates. The BGP thread now supports IPv6 transport and mapping to sFlow/NetFlow agents; BGP peer information is linked into the status table for caching purposes, which results in good CPU savings on bigger deployments.
Release Notes: The BGP daemon implements a new memory model that leads to consistent memory savings. The NetFlow probe plugin, "nfprobe", now supports direction field (NetFlow v9 field type #61). nfacctd now supports Cisco ASA bytes counter, NetFlow v9 field type #85, and improved flow recognition heuristics for cases in which IPv4/IPv6/input/output data are combined within the same NetFlow v9 template. This release also includes some bug fixes.