NAME:
  pmacct (Promiscuous mode IP Accounting package) v0.11.0rc3
  pmacct is Copyright (C) 2003-2006 by Paolo Lucente


DESCRIPTION:
  pmacct is a small set of passive network monitoring tools to measure, account,
  classify, aggregate and export IPv4 and IPv6 traffic; a pluggable and flexible
  architecture allows to store collected network data into memory tables or SQL
  (MySQL, SQLite, PostgreSQL) databases and export them through NetFlow or sFlow
  protocols to remote collectors. pmacct supports fully customizable historical
  data breakdown, flow sampling, filtering and tagging, recovery actions, and
  triggers. Libpcap, sFlow v2/v4/v5 and NetFlow v1/v5/v7/v8/v9 are supported, both
  unicast and multicast. Also, a client program makes it easy to export data to
  tools like RRDtool, GNUPlot, Net-SNMP, MRTG, and Cacti.

  Aggregation revolves around the key concept of primitives (source and destination
  MAC addresses, hosts, networks, ports, AS numbers, VLAN id, IP protocol and ToS/DSCP
  field are supported) which may be arbitrarily combined to build custom aggregation
  methods. Layer 7 (application) classification is fully extensible: classifiers are
  either based over regular expressions (RE) patterns or dynamic shared objects (SO).
  They are both loaded at runtime. Many RE patterns for popular protocols are already
  available through the L7-Filter project.

  IP accounting is the key for a range of operations like billing, live or historical
  traffic analysis or pricing models application; it is also a valuable way to go for
  the enforcement of thresholds while measuring the the underlying network.  
  Taking SNMP data from physical or virtual interfaces of network equipments sometimes
  is not too useful because of coarse granularity of counters. Finer granularities are
  reached if counters match consistent logical entities (such as departmental networks,
  Autonomous Systems, specific traffic flows, etc.).

  Many network equipments support redirection of network traffic to a replication port;
  non-blocking architectures help in not negatively affect the global performances and
  routing/forwarding operations when mirroring data. Alternatively, software probes or
  high-end equipments implement export protocols, like sFlow or Netflow. Both them leave
  leave new chances to monitor the network online (but not inline), off critical paths.
  This translates in new opportunities arising for advanced data manipulation or post-
  processing activities.


REQUIREMENTS:
  libpcap >= 0.6.x  -- http://www.tcpdump.org/


PLATFORMS:
  It has been tested and reported to work on:

  Red Hat Linux 7.x/8.x/9.x
  Fedora Core 1/2/3/4/5
  Slackware Linux 8.x/9.x/10.x
  Gentoo Linux 1.4.x/1.6.x
  SuSE Linux 9.x/10.x
  Debian 3.x
  Solaris 8/9/10 x86/sparc
  FreeBSD 4.x/5.x/6.x x86/sparc 
  OpenBSD 3.7/3.8/3.9 x86/sparc
  NetBSD 2.0 x86
  MacOS X 10.4
  LEAF Bering-uClibc

  Did you successfully completed compilation and installation of the
  software on some other operating system or architecture not listed
  here ? Please, let me know. 


NETFLOW:
  Supported versions: V1/V5/V7/V8/V9

  NetFlow packets have been read successfully from:
  Cisco 2500, 2600, 3600, 7500, 12000; IOS 11.2, 12.0(30)S, 12.1, 12.3
  Juniper M10; JunOS 6.2, 6.4

  Did you successfully read NetFlow packets from other network equipments
  not listed here ? Please, let me know.


SFLOW:
  Supported versions: V2/V4/V5

  sFlow packets have been read successfully from:
  HP Procurve 2800 series (fw: I.08.58) 
  HP Procurve 4200 series (fw: L.10.02) 
  HP Procurve 9300 series (fw: I.07.7.01) 
  Foundry Networks Bigiron 8000 JetCore Router (fw: 07.7.01e)
  Foundry Networks Bigiron 8000 IronCore (fw: 07.7.01e)
  Foundry Networks FastIron FWS2402 (fw: 02.2.01)
  Foundry Networks FastIron FESX424
  Force10 E300 (fw: 6.2.1.0)

  Did you successfully read sFlow packets from other network equipment ?
  Please, let me know.


INSTALLATION:
  see INSTALL and EXAMPLES files


LICENSE:
  GNU GENERAL PUBLIC LICENSE
  see COPYING for details.


CONTACTS:
  see AUTHORS file.  


Cheers,
Paolo
