$Revision: 1.16 $

		ipcad - IP accounting daemon README


OVERVIEW:

	IPCAD stands for IP Cisco Accounting Daemon. It runs in background and
listens traffic on the specified interfaces. ipcad uses raw BPF devices
(/dev/bpf*), PCAP library (pcap(3)) or Linux iptables' ULOG (>=2.4.18-pre8)
packet sources.

	IPCAD may export the collected information using rsh or NetFlow.
Alternatively, a table could be printed to the standard output or the
console upon receiving a SIGINT signal (Ctrl+C).

	Configurable features are explained in the sample ipcad.conf
and the corresponding ipcad.conf(5) manual page.


ACCOUNTING:

	There are three methods of accessing the collected data.

	* Interactive
The accounting tables are printed upon receiving the SIGINT signal.
The statistics table, compatible with Cisco "show ip accounting" format,
will be displayed on console.  If ipcad is not in the daemon mode,
you can just press Ctrl+C to see the table (and Ctrl+\ to kill ipcad).

	* RSH export
The ipcad also has a built-in rsh server. RSH behavior is fully compatible
with the standard rsh protocol (rshd(8)), with exception that it NEVER
checks the /etc/hosts.allow or .rhosts.

	* NetFlow export
The ipcad can export the accounting flow using the NetFlow format,
i.e. series of UDP packets which contain the aggregated information.


SUPPORTED RSH COMMANDS

	Supported rsh commands simulating Cisco behavior are:

		show ip accounting
		show ip accounting checkpoint
		clear ip accounting
		clear ip accounting checkpoint
		show ip cache flow
		show interface <iface>

	Of course, there are abbreviations too:

		sh ip acco		# show ip accounting
		sh ip acco che		# show ip accounting checkpoint
		cle ip acco		# clear ip accounting
		cle ip acco che		# clear ip accounting checkpoint
		sh ip ca flo		# show ip cache flow
		sh in <iface>		# show interface <iface>

	Other supported commands:

		help	# Built in help
		stat	# Print some statistics apart from table
		dump [<pathname>] # Dump the table into the specified file
		restore [<path>]  # Restore the table from the specified file
		import  [<path>]  # Import (add) entries from the specified file
		shutdown # Shutdown ipcad

	Full list of supported commands can be accessed by issuing a
"rsh localhost help" command when ipcad is running.


COMMAND LINE OPTIONS:

	There are few command line options recognized by ipcad. There are:

		-h:     this help page
		-d:     become daemon (otherwise, work in foreground)
		-c:     specify configuration file
		-r:     import the dump file on startup
		-s:     dump the active table on exit


	Typical start string may look like this

		ipcad -rds

	(Import previously saved state table, become daemon, and save
	state on exit).


-- 
Lev Walkin
vlm@lionet.info
