pmacct

This release introduces support for the Linux Netlink/ULOG packet capturing framework (uacctd) and NetFlow v9 sampling via Options template management. Support is also introduced for external sampling sources (i.e. sampled packet mirroring, PF_RING, or ULOG). Tag capabilities have been improved. There are various bugfixes.

The BGP daemon thread was tied up with the NetFlow and sFlow probe plugins to encode dynamic AS information. The 'bgp_neighbors_file' feature was introduced to write a list of BGP neighbors in the Established state to a specified file for automation/auto-discovery purposes. The 'bgp_stdcomm_pattern' feature was improved by the support of the regex '.' wildcard symbol. The 'bgp_stdcomm_pattern_to_asn' feature was also introduced to cope with IP prefixes on their own address space: part of the community is mapped onto the peer AS field, and part onto the origin AS field. There are code cleanups and fixes.

A BGP daemon thread featuring per-peer RIBs was integrated in both NetFlow and sFlow collectors, nfacctd, and sfacctd. As a result, additional aggregation primitives are supported. These include standard and extended communities, AS-PATH, Local Preference, MED, and BGP next-hop. Origin and peer ASNs are supported at the same time, and careful support for source peer AS is introduced. 32-bit ASNs have been implemented throughout Netflow and sFlow collectors and probes. Tags have been increased to 4 bytes from 2. There are minor fixes.

This release introduces support for tag ranges into the Pre-Tagging infrastructure. tcpdump-style filters, e.g. 'aggregate_filter', now support indexing within a packet, e.g. 'ether[12:2]', to allow more flexible separation of the traffic. There are fixes to libpcap, sFlow, and NetFlow collectors, the MySQL plugin, stream classification, and IPv6 code.

The SQL UPDATE query code has been rewritten for increased flexibility. A new sql_locking_style directive, row or table granularity, is now supported in the MySQL plugin. Support for Endace DAG cards was introduced. The Linux cooked device (DLT_LINUX_SLL) handler has been enhanced by supporting 'src_mac' and 'vlan' aggregation primitives. A number of bugs have been fixed.