$Revision: 1.19 $

		ipcad - IP accounting daemon README


OVERVIEW:

	IPCAD stands for IP Cisco Accounting Daemon. It runs in background and
listens traffic on specified interfaces. ipcad uses raw BPF devices
(/dev/bpf*), PCAP library (pcap(3)), Linux iptables' ULOG (>=2.4.18-pre8)
and IPQ (libipq(3)), BSD divert(4) and tee packet sources.

	IPCAD exports the collected information via rsh or NetFlow protocols.
Alternatively, a table can be dumped into the specified file, or printed
to the standard output or console upon receiving a SIGINT signal (Ctrl+C).

	Configurable features are explained in the sample ipcad.conf
and the corresponding ipcad.conf(5) manual page.


ACCOUNTING DATA EXPORT:

	There are three methods of accessing the collected data.

	* Interactive
The accounting tables are printed upon receiving the SIGINT signal.
The statistics table, compatible with Cisco "show ip accounting" format,
will be displayed on console.  If ipcad is not in the daemon mode (-d),
you can just press Ctrl+C to see the table (and Ctrl+\ to kill ipcad).

	* RSH export
The ipcad also has a built-in rsh server. RSH behavior is fully compatible
with the standard rsh protocol (rshd(8)), with exception that it NEVER
checks the /etc/hosts.allow or .rhosts.
Please see an ipcad(8) manual page for the list of supported RSH commands.

	* NetFlow export
The ipcad can export the accounting flow using the NetFlow format,
i.e. series of UDP packets which contain the aggregated information.
Please see an ipcad.conf(5) manual page for NetFlow configuration options.


-- 
Lev Walkin
vlm@lionet.info
