pmacct

The 'sfprobe' plugin can now transport packet/flow classification tags inside sFlow v5 datagrams. Then, such tags can be read by the sFlow collector, sfacctd; it is also able to encapsulate basic Extended Gateway information (src_as, dst_as) starting from a Networks File. 'nfprobe' now supports network data coming from a libpcap/tcpdump style save file. pmacctd is now able to capture packets from BSD loopback encapsulation link type. The sampling layer has been improved: it's now able to sample flows from NetFlow datagrams.

The 'nfprobe' plugin can now transport packet/flow classification tags inside NetFlow v9 datagrams. It has the ability to select an Engine Type/Engine ID through a newly introduced 'nfprobe_engine' config directive, and automagically select different NetFlow v9 template IDs, which is useful when multiple 'nfprobe' plugins run as part of the same daemon instance. The 'sfprobe' plugin is now able to redistribute NetFlow flows into sFlow samples. The documentation has been updated with examples and quickstart guides on how to use pmacct as a NetFlow and sFlow emitter.

pmacct daemons are now able to create and export both sFlow and NetFlow packets. The new 'nfprobe' plugin allows you to create NetFlow v1/v5/v9 datagrams and export them to an IPv4/IPv6 collector. The 'sfprobe' plugin allows you to create sFlow v5 datagrams and export them to an IPv4 collector. The source of network data can be either libpcap or incoming sFlow/NetFlow streams. There are minor fixes.

New Pre-Tagging keys were introduced to conditionally alter the order in which rules are evaluated: 'label' marks the rule with label's value, 'jeq' (Jump on EQual) allows a jump to the supplied label in the case of a rule match, and 'return', if set to 'true' (which is default setting) returns the current packet/flow to active plugins in the case of a match. If switched to 'false', it will prevent this from happenning. 'stack', when matching, accumulates ID using the specified operator/function. The Pre-Tagging table now supports a maximum of 384 rules.

A new '-l' option is supported by the pmacct client tool: it allows you to enable locking of the memory table explicitly. The pre-tagging infrastructure (with the exclusion of id, ip and filter keys) and pre_tag_filter configuration directive now feature negations. Documentation has been updated. Unofficial SUSE RPMs are available.