All releases of pmacct
Release Notes: The BGP daemon now features an implementation of BGP/MPLS VPNs (rfc4364): it correlates <router IP, input/output interfaces ifIndex)> couples to Route Distinguisher (RD) values. The print plugin can now write network traffic data to flat-files (print_output_file) featuring formatted or CSV output, dynamic filenames, historical breakdown, and triggers. pmacctd now supports the DLT_LOOP link-type (i.e. OpenBSD tunnel interfaces). Several enhancements to the uacctd daemon and other minor new features and miscellaneous fixes are included.
Release Notes: A sampling_map feature has been introduced, allowing definition of static traffic sampling mappings. Further work on the NetFlow v9/IPFIX sampling includes support for 16 bits SAMPLER_IDs (seen against IOS-XR) and support for (FLOW)_SAMPLING_INTERVAL fields as part of the NetFlow v9/IPFIX data record. [ns]facctd_as_new and [ns]facctd_net both feature a new "fallback" option to look up BGP-related primitives against BGP first and, if not successful, against the export protocol. Other minor new features and misc. fixes are also included in this release.
Release Notes: IPFIX (IETF IP Flow Information Export protocol) probe, replication, and collector capabilities have been introduced. Support for BerkeleyDB 5.x via the SQLite3 plugin has been added. It is now possible to get BGP-related traffic primitives (AS Path, local preference, communities, etc.) from a slow Extended Gateway object. Support has been introduced for NetFlow v9/IPFIX source and destination peer ASN field types 128 and 129. The pmacct client is now able to produce Comma-Separated Values (CSV) output in addition to formatted-text output, easing integration with 3rd party tools.
Release Notes: nfacctd, the pmacct NetFlow collector, has been enhanced to support NAT L3/L4 fields (IPFIX field types 225, 226, 227, 228, 281, and 282), Cisco ASA NetFlow v9 NSEL (field types 40001, 40002, 40003, 40004 152, 153, and 323) and application classification (aligning to Cisco NBAR-NetFlow v9 integration). The NetFlow probe plugin, nfprobe, introduces egress IPv4/IPv6 NetFlow v9 templates. The BGP thread now supports IPv6 transport and mapping to sFlow/NetFlow agents; BGP peer information is linked into the status table for caching purposes, which results in good CPU savings on bigger deployments.
Release Notes: The BGP daemon implements a new memory model that leads to consistent memory savings. The NetFlow probe plugin, "nfprobe", now supports direction field (NetFlow v9 field type #61). nfacctd now supports Cisco ASA bytes counter, NetFlow v9 field type #85, and improved flow recognition heuristics for cases in which IPv4/IPv6/input/output data are combined within the same NetFlow v9 template. This release also includes some bug fixes.
Release Notes: A 'cos' aggregation primitive has been implemented, providing support for 802.1p priority. TCP MD5 signatures are supported as part of the BGP daemon. In nfprobe and sfprobe, the concept of traffic direction has been introduced, and as a result [ns]fprobe_direction and [ns]fprobe_ifindex config directives have been implemented. Switch Extension Header support and Counter Samples for multiple interface features have been added in sfprobe. A number of bugfixes are included.
Release Notes: A 'tee' plugin is being introduced, and brings both NetFlow and sFlow replication capabilities. 'nfprobe' and 'sfprobe' plugins have support for exporting of the BGP next-hop information. The BGP daemon is now able to mark self-originated messages with a supplied IP precedence value. The 'print' plugin can now present results as Comma-Separated Values (CSV) in addition to formatted text. pmacctd has improved 802.1ad support. There are some bugfixes.
Release Notes: Support for input/output interfaces (SNMP indexes) and source/destination IP prefix masks has been introduced via additional aggregation primitives. A generic tunnel inspection infrastructure has been developed to benefit both pmacctd and uacctd daemons: GTP, the GPRS tunneling protocol being the only supported protocol. Support for the MAC layer has been added for the Netlink/ULOG Linux packet capturing framework. A new 'nfprobe_source_ip' feature allows you to select the IPv4/IPv6 address to be used to export NetFlow datagrams to the collector.
Release Notes: The "is_symmetric" aggregation primitive has been implemented and is aimed at easing detection of asymmetric traffic. Tagging is now possible on the following BGP primitives: src_local_pref, local_pref, src_comms, comms (match-any or match-all fashion), and src_peer_as. Documentation and examples have been updated; various fixes are also included.
Release Notes: New BGP primitives have been introduced: src_as_path, src_std_comm, src_ext_comm, src_local_pref, and src_med. A new 'bgp_follow_nexthop' feature is aimed at networks not running MPLS, where hop-by-hop routing is in place. A new 'bgp_peer_as_skip_subas' feature allows this release to return the first ASN that is not part of a BGP confederation when computing peer_src_as and peer_dst_as primitives. The ULOG accounting daemon (uacctd) introduces support for input and output interfaces. A new feature is added to set source/destination ASNs, part of NetFlow/sFlow exports, to the peer AS rather than origin AS.
