Index: ChangeLog =================================================================== RCS file: /var/cvs/pfflowd/ChangeLog,v retrieving revision 1.3 retrieving revision 1.5 diff -u -r1.3 -r1.5 --- ChangeLog 23 Jun 2003 09:04:18 -0000 1.3 +++ ChangeLog 15 Aug 2003 02:09:32 -0000 1.5 @@ -1,3 +1,9 @@ +20030815 + - (djm) Add -n option to usage message. Spotted by jose AT monkey.org + - (djm) Document current issues in manpage + - (djm) Fix manpage formatting command hint in README + - (djm) Release pfflowd-0.3 + 20030623 - (djm) Drop privileges and chroot to /var/empty on non-debug startup - (djm) Release pfflowd-0.2 Index: README =================================================================== RCS file: /var/cvs/pfflowd/README,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- README 22 Jun 2003 03:52:15 -0000 1.2 +++ README 15 Aug 2003 02:09:32 -0000 1.3 @@ -13,7 +13,7 @@ More details about pfflowd's function and usage may be found in the supplied manpage, which you can view prior to installation using -/usr/bin/nroff -c -mandoc pfflowd.8 | less +/usr/bin/nroff -mandoc pfflowd.8 | less pfflowd itself is licensed under a two-term BSD license (see the source files for details). @@ -23,3 +23,4 @@ or questions, please email me: Damien Miller + Index: TODO =================================================================== RCS file: /var/cvs/pfflowd/TODO,v retrieving revision 1.2 retrieving revision 1.4 diff -u -r1.2 -r1.4 --- TODO 23 Jun 2003 09:03:11 -0000 1.2 +++ TODO 15 Aug 2003 01:51:23 -0000 1.4 @@ -5,10 +5,18 @@ states whose labels match - What to do if ruleset changes under us? +* NetFlow v.5 support + - A few extra fields + - Very easy + +* NetFlow v.9 export + - Supports IPv6! + - http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm + * sflow export (www.sflow.org) * IPv6 export support - - Needs sflow, as Netflow doesn't do IPv6 + - Needs sflow or NetFlow v.9 * Cleanup of code - Kill globals in favour of ctxt @@ -20,4 +28,16 @@ * More netflow fields - Most require kernel support - May be able to (partially) infer tcp flags + +* Companion daemon which reads from pflog to log blocked/dropped packets + (maybe) + +* Kernel support for reporting state counter wraparound + - Check counters on kernel side + - Upon receipt of a packet which would cause either flow counter to wrap, + send a (new) pfsync info message with the state data + - Reset state's counters to zero + len of current packet + +* Kernel changes to account for generated packets + - Which ones? ICMP is arguably not appropriate... Index: pfflowd.8 =================================================================== RCS file: /var/cvs/pfflowd/pfflowd.8,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- pfflowd.8 23 Jun 2003 09:03:12 -0000 1.2 +++ pfflowd.8 15 Aug 2003 02:01:45 -0000 1.3 @@ -1,4 +1,4 @@ -.\" $Id: pfflowd.8,v 1.2 2003/06/23 09:03:12 djm Exp $ +.\" $Id: pfflowd.8,v 1.3 2003/08/15 02:01:45 djm Exp $ .\" .\" Copyright (c) 2003 Damien Miller. All rights reserved. .\" @@ -103,6 +103,17 @@ packet filter. This filter will cause .Nm to ignore the specified traffic. +.Sh BUGS +A bpf program specified on the commandline does not do what one may expect +(select traffic for accounting). +.Pp +Flows over 2^31 bytes will be incorrectly accounted as the in-kernel byte +counter will wrap around. +.Pp +.Nm +does not try to avoid generating NetFlow packets for flows resulting from +its own datagram output. +This is easily avoided by not creating state on this traffic. .Sh AUTHORS Damien Miller .Sh SEE ALSO Index: pfflowd.c =================================================================== RCS file: /var/cvs/pfflowd/pfflowd.c,v retrieving revision 1.4 retrieving revision 1.6 diff -u -r1.4 -r1.6 --- pfflowd.c 23 Jun 2003 09:04:18 -0000 1.4 +++ pfflowd.c 15 Aug 2003 02:11:37 -0000 1.6 @@ -22,7 +22,7 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -/* $Id: pfflowd.c,v 1.4 2003/06/23 09:04:18 djm Exp $ */ +/* $Id: pfflowd.c,v 1.6 2003/08/15 02:11:37 djm Exp $ */ #include #include @@ -52,7 +52,7 @@ #include #define PROGNAME "pfflowd" -#define PROGVER "0.2" +#define PROGVER "0.3" #ifndef PRIVDROP_USER # define PRIVDROP_USER "nobody" @@ -147,6 +147,7 @@ { fprintf(stderr, "Usage: %s [options] [bpf_program]\n", PROGNAME); fprintf(stderr, " -i interface Specify interface to listen on (default %s)\n", DEFAULT_INTERFACE); + fprintf(stderr, " -n host:port Send NetFlow datagrams to host on port (mandatory)\n"); fprintf(stderr, " -r pcap_file Specify packet capture file to read\n"); fprintf(stderr, " -d Don't daemonise\n"); fprintf(stderr, " -D Debug mode: don't daemonise + verbosity\n");