pmacct

AS numbers and IP addresses are no longer multiplexed into the same field. A new SQL table version, v6, has been introduced in order to support this new data model in all SQL plugins. Minor fixes to PostgreSQL table schemas, v2 to v5; an alignment issue has been caught when the etheraddr_string() gets called from count_src|dst_mac_handlers() in sql_handlers.c. An issue with mask_elem() in server.c has been fixed: both src|dst_net primitives were not (positively, i.e. copied back when required) masked.

Collectors are now compiled exporting the full dynamic symbol table, which allows DSO classifiers to call routines included in the collector code. The classifiers table is now loaded in a shared memory segment to keep plugins updated about the changes, and is dynamically allocated at runtime, allowing an arbitrary number of classifiers to be loaded. The Pre-Tagging infrastructure adds two new primitives to tag network traffic: src_as and dst_as. The PostgreSQL plugin no longer makes use of exclusive locks whenever the sql_dont_try_update directive is activated.

Application layer (L7) classification through the use of dynamic shared object (SO) classifiers has been introduced. The 'classifier_tentatives' config key has been added; it allows you to customize the number of tentatives made in order to classify a flow. Support for token ring (IEEE 802.5) interfaces has been introduced in pmacctd. Management of the connection tracking buffer has been changed: now, a successful search frees the matched entry instead of moving it in a chain of stale entries, and it is available for quick reuse. Error logging of SQL plugins has been greatly improved.

Connection tracking modules have been introduced
for FTP, SIP, and RTSP protocols: they hint IP
address/port couples for upcoming data streams as
signalled by one of the parties into the control
channel. The "pidfile" directive way of working
has been improved. Various bugfixes have been made
to the classification engine.

Support for 'sql_multi_values' has been introduced into the SQLite 3.x plugin. It allows you to chain multiple INSERT queries into a single SQL statement. MySQL plugin fix: AS numbers were sent to the database unquoted while the corresponding field was declared as CHAR; by correctly wrapping AS numbers, a major performance increase has been confirmed. 'pidfile' key behaviour has been corrected in both nfacctd and sfacctd. The 'daemonize' key was incorrectly disabling the signal handlers from the Core Process; the issue has been fixed.