forked from phaag/nfdump
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
executable file
·678 lines (579 loc) · 25.9 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
- internal: put output parameters in a single struct
- Fix GuessDir bug - issue #215
- Compact Changelog
- Fix GuessDir bug - issue #215 in flow exporter
2020-03-29
- Release 1.6.20
- More cleanup on plain number printing
- Fix plain numbers bug #213
- Fix profiler filer bug
2020-02-22
- Release 1.6.19
- Add Source security group tag (SGT 34000) issue #192
- Modify heuristic for bidir flows #59
- Add Push for new sgt tag.
- Cleanup unused nffile records. Add nffileV2.h
- Fix various compiler warnings and automake issues
- Remove external global vars
- Set verbose logging off by default in non daemon mode
- Fix make check
- Remove old legacy records
- Major code rearrangement in order to prepare for futur versions of nfdump
Move extension definitions into extension files nfx.h
Move exporter definition into extension.h
nffile.h should only contain nffile data block handlich definitions
- Fix compile error for FreeBSD #203
- Cleanup header code - add new filter.h - free nfdump.h from dust
- More code cleanup - delete nf_common - add output_fmt
- Fix bug for IPv6 network cidr representation in raw and cvs output mode.
- Remove unused old code. Fix for #197
- Fix bidir export issues. Cleanup code. Fix for #195
- Enable small time intervals < 60s. - #185
- Cleanup old code
- Fix minor nfpcapd issues
- Fix gcc compile issue
- Fix corrupt file handling #193
- More code cleanup. Move code to dedicated files.
- Restructure code for output into separate files.
- Cleanup old code.
- Fix bug #189 - valid json output
- Fix issue #190. Add compile time option for JunOS.
- Cleanup configure.ac
- Fix various c11 compile issues
- Cleanup old compat15 comments
- Add vlan tags dot1qVlanId, 243, 254 - #182
- Fix sflow issue with Arista switches
- Fix ft2nfdump next hop and ip router fields
- Cleanup and fix IPv6 network display in war records.
- Fix compile issues
- Fix output buffer size for lzo1x_decompress_safe()
- Fix VerifyExtensionMap #179
- Fix compile errors
2019-08-05
- Release 1.6.18
- Fix nfdump.1 man page. #175
- Fix off by 1 array. #173
- Fix use after free in ModifyCompressFile
- Add bound checks in AddExporterStat #174
- Add bound checks in AddSamplerInfo #176
- Add bound checks in AddExporterInfo
- Fix checks in InsertExtensionMap #177
- Remove COMPAT15 code - should no longer be needed.
- Merge pull request #167
- Cleanup old code
- Replace depricated pcap_lookupdev call in nfpcapd
2019-07-31
- Add early record size sanity check also for nfprofile, nfanon and nfreplay
2019-07-26
- nfpcapd cleanup, add some more monitoring
- Fix hbo_exporter.c:249_1 segfault
- Fix hbo_nffile_inline.c:85_1 segfault
- Fix hbo_nfx.c:216_3 segfault
- Update minilzo to v2.10
- Change to safe lzo decompress function
2019-07-25
- Rework nfpcapd and add it officially to the nfdump collection.
- Add nfpcapd man page
- Fix potential unsigned integer underflow #171
2019-07-16
- Add latency extension if dumping flowcache
2019-07-15
- Fix typos
- Fix exporter struct inconsistancies. Coredump on ARM otherwise.
2019-07-02
- Add ipfix element #150, #151 unix time start/end
- Fix display bug raw record
2019-06-01
- Add ipfix dyn element handling.
- Add empty m4 directory - keep autoconf happy
2019-06-01
- Fix issue #162 - ipfix mpls sequece.
- Fix issue #156 - print flowtable index error
2019-03-17
- Fix spec file
- Remove non thread safe logging in nfpcapd
2018-11-24
- Fix protocol tag for protocol 87 - TCF - #130
- Add TCP flags ECN,CVR - #132
- Fix some error messages to be printed to the correct stream #135
- Add missing -M command line help to nfcapd
- Remove padding byte warning in log #141
- Fix bug to accept -y compression flag in nfcapd. - #145
2018-06-24
- Fix bookkeeper type - use key_t
- Add multiple packet repeaters to nfcapd/sfcapd. Up to 8 repeaters (-R) can be defined.
- Ignore OSX .DS_Store files in -R file list
- Add CISCO ASA elements initiatorPackets (298) responderPackets (299)
- Merge #120 pull request for -z parameter to nfreplay
- Update man page nfreplay
2018-05-06
- New bookkeeper hash broke NfSen. Fixed. ported back to release 1.6.17
2018-04-20
- Release 1.6.17
2018-04-20
- Fix bug in sorting when guessing flow direction. Issue #92
- Update nfdump.1 man page for xsrcport & xdstport aggregations. Request #109
- Fix minor bugs
- Fix definition for InfluxDB in configure.ac Issue #98
2018-04-01
- Add program exit in nfx.c after panic with correupt data file
- Add missing size check when reading nfdump 1.5.x common record blocks
- Add missing option -M in man page. Issue #103
- Add Fix processing of influx URL in nfprofile
2018-02-11
- Add missing json output format in nfdump help text
- Add missing -v option in nfreplay help text
2018-01-06
- Merge pull request #51 Influxdb from Luca. Thx for the patch
2018-01-01
- IPFIX time stamps - Fix elements #21,#22 offset calculation, but timestamps not yet evaluated. (#160)
- IPFIX add fwd status tag #89 compatible to v9 (1byte)
2017-12-31
- IPFIX sampling - sampling algorithm no longer required for tag #34
- IPFIX sampling add tags #305 and #304 - set them identical to #34, #35
2017-12-30
- Add new output format json. Print each record as individual json object
2017-12-28
- Add sampling elements ID 302,304,305. put them identical to ID 48,49,50
- Add option to label filter terms. syntax: (<filter>) %labelname.
- Add %lbl option to print flow label in output
- Update nfdump(1) man page for flowlabels
2017-12-27
- Add ipfix delta timestamp elements 158/159.
- Update sflow code to commit 7322984 of https://github.com/sflow/sflowtool
- Cleanup sflow code - uncomment unnecessary code
- Fix header includes"
- Fix 64bit fts compat issue in fts_compat.c
- Add more detailed autogen.sh - softlink bootstrap
2017-12-22
- Fix potential memory leaks in nfpcapd
2017-12-21
- Fix wrong offset calculation if unknown options are found
- Add x-late src/dst ip aggregation, if compiled with NSEL support
2017-12-17
- Add ipfix sampling. Process option template/record with sampling elements 34 and 35
- Report updates on existing samplers in v9 only if values change. issue 84
2017-11-05 v1.6.16
2017-12-10
- Add lz4 compression
- Remove old xstat legancy code, not needed
- Remove automake files from git
2017-12-03
- Fix old 1.6.15 tags
- Fix minor issues and compiler warnings
2017-10-22
- Add support for CISCO IOS 8 bytes timestamps ID 21/22
- Fix issue #72 - multiple stat output
- Change -B behaviour as proposed in issue #59. Should not impact with previous use, but is more flexible
- Add bzip compress switch in usage output of nfpcapd
- Fix compile issues on some platforms
- nfpcapd improvements - still beta software.
- Minor bug fixes
2016-11-25
- Add latency extension to nfpcapd
- Smaller bug fixes to nfpcapd
2016-07-23
- Replace unreliable _ftok with more reliable string hash
2016-07-20
- Aggregate using in+out bytes for bidirectional flows
2016-06-05 v.1.6.15
- Fix Security issue http://www.security-assessment.com/files/documents/advisory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabilities.pdf
- Fix obyte, opps and obps output records
- Fix wrong bps type case in cvs output. Fix opbs ipbs typos
2016-01-10 v.1.6.14
- Fix CentOS compile issues with flow-tools converter
- Fix FreeBSD,OpenBSD build problems
- Fix timestamp overflow in sflow.c
2015-12-23
- Fix IP Fragmentation in sflow collector
- Create libnfdump for dynamic linking
2015-10-02
- Fix compile errors on other platforms
- Add -R to ModifyCompression
- Add std sampler ID 4 Bytes and allow random sampler (tag 50)
- Add BZ2 compression along existing LZ0
- Add direct write to flowtools converter ft2nfdump
- Fix zero alignment bug, if only half of an extension is sent
- Fix nfanon time window bug in subsequent files in -R list
- Fix CommonRecordV0Type conversion bug
- Fix nfexport bug, if only one single map exists
2014-11-16 v.1.6.13
- Fix v1 extension size bug
- Add htonll check for autoconf
- Fix AddExtensionMap compare bug
- Fix ipfix templare withdraw problems - free all maps correctly
- Add minilzo 2.08 - fixes CVE-2014-4607
- Cleanup some stat code. more needs to be done ..
- Cleanup man pages for -O -n
- Remove SunPro test in configure - no longer supported anyway
- Cleanup NAT/NSEL filter differences
2014-06-15 v1.6.12p1
- Add pblock compare functions
- Update extended filter: Allow modification left/right values
2014-02-16 v1.6.12
- Add NAT pool port allocation
- Modify/fix NAT vrf tags. Add egress vrf ID
- Modify common record due to exporter exhaustion. new common record
type 10 adds 4 extra bytes. Reads v1 common record transparently
- Fix sflow potential crash
2013-11-13 v1.6.11
- Add ASA/NSEL 9.x protcol changes
- Make it llvm compilable
2013-08-12 v1.6.10p1
- Fix -t +/- n timeslot option
- Fix bug in nfanon - stat record update.
- Fix bug in netflow v5 mudule: extension map size wrong.
- Fix bug nfexport: In some cases could result in wrong flow counter.
- Fix nftrack - could coredump in some cases.
2013-05-16 v1.6.10
- Fix SPARC compile/optimise bug
- Add output packet/bytes counter to global stat - importatnt for NSEL flows ASA > 8.5
- Add NSEL filter options xnet
- Modify extension descriptor code for nfdump1.7. Still use 1.6 extension map layout for compatibility
- Add prototype for nfpcapd - pcap -> nfdump collector. Converts traffoc directly to nfdump files.
- Fix bug in ipfix module: uninitialised variable
- Cleanup syslog/LogError calls
- Fix minor non critical bugs and compile issues
2013-03-02 v1.6.9
- Fix some bugs in beta 1.6.9 NSEL code
- Fix bug statistics update with aggreagted flow records
- Fix sflow bug sfcapd stores wrong (ghost) dump by past samples in same sflow datagram
2012-12-31
- Add time received in csv output
- ICMP should handled better now - somewhat
- Implement ASA NSEL records
- Add definitions in nffile and nx for ASA NSEL extensions
2012-11-09 v1.6.8p1
- Add dynamic source directory tree for multiple exporters
- Fix exporter bug: 'too many exporters' with large time windows
- Fix uninitialised exporter sysid in default sampler record - v9
- Fix v9/ipfix cache initialisation with no templates > 1 in same packet
2012-10-26 v1.6.8
- Add ip list option for 'next ip' in filter syntax
- Accept v9 sampler_id in 2bytes
- Fix IPFIX mac address bug - did not get collected
- Add IPFIX packet/octet TotalCount fields 85/86
- Add received timestamp to sflow collector
- Fix long flow duration calculation - 32bit overflow
- Fix v9 sampling ID: allow 2 byte ID
- Add IPFIX options as rfc5101 section-6.2
- Add exporter records for sflow collector
- Fix bug for MAC address printing %idmc and %odmc.
- Add received time stamp extension
- Add recursive format parser. Allows to extend predefined formats.
- Change flow record sorting to heapsort. remove limit 1000
- Merge -m option to -O tstart. -m now depricated.
- Add -O tend. Print order according to tend of flows ascending
- Apply -O print order for printing flow cache. Applies to -A
2012-07-31 v1.6.7-tc-1
- Special version for TC
- Print exporter and sampling records with nfdump -E
- Added exporter and sampling records to file.
2012-07-30 v1.6.7
- Prepare for file catalog in current file format.
- Fix bug in ReadBlock when reading flow from stdin pipe
- Add new more flexible translation engine for v9
- Add nprobe client/server delay fields
- Prepare for NSEL merging
- Fix memory corruption with double -A flags
- Fix bug in nfreader with compat15 mode files
2012-03-12 v1.6.6
- Minor IPFIX bug.
- IPFIX implement template withdraw
- For IPFIX, check packet sequence per template and observation domain
- Fix time window, when no flows collected or no flows matched
while processing
- Fixed typos
- Fix seg fault bug - test for EMPTY_LIST was missing at several places.
2012-02-19 v1.6.6b1
- Fix bps/pps. make it uint64_t, as bps/pps > 4Gb/s overflows.
- In record raw print mode: decode ICMP instead of src/dst ports
- sflow use announced exporter IP instead of sending IP for router ID
- sflow: Ignore extra fill bytes. Do not complain.
- sflow: fix packet length issue.
- Add IPFIX protokoll support
2011-12-31 v1.6.5
- Fix 64bit bug when using byte/packet limits
- for v5 and sampling use 64bit counters to prevent overflow for large sampled flows.
- Fixed Ident printig bug
2011-07-11 v1.6.4
- some code restructuring - prepare for IPFIX module
- Add netflow v1 module. Some routers still use that
- Add %sn, %dn output tags for src/dst networks
- Fix buffer length check in v5.
- Fix export bug: include last flow cache bucket, when exporting
- number in all filter expressions accept hex values
- fix an sflow colletor bug. Missing extension maps in rotated files
- implement extended statistics. Currently ports and bpp distribution
vectors can be collected automatically be nfcapd. Still experimental
2011-02-26 v1.6.3p1
- Fix timebug fix :(, make it a compile time option
- fix v7 sequence errors
2011-02-15
- Zero out unused fields after aggregation
2011-02-05
- Fix SysUptime 32bit overflow in v5 header
- Add fix for strange first/last swap reported by some users.
2011-01-09 v1.6.3
- Fix extension size bug
- Move IP anonymisation to separate binary nfanon
- Fix initialise bug of -o fmt: and not available fields
2010-09-09 v1.6.2
- released
- fixes some sflow bugs in sfcapd
2010-04-28 v1.6.1p0
- Update flow tools converter to build with Google-Code version 0.68.5
- Fix sflow bugs
2010-03-05 v1.6.1
- Fix bug in man page for -t
- Test sampler infos before using them ( nfcapd startup )
- Add sampling tags #34, #35 used by JunOS
- nfexpire: Fix empty .nfsat, when setting limits on an empty directory
- Fix coredump for -B -m (-w) combination
- Optimise some extension map code
2009-12-28 stable v1.6
- Few bug fixes in release candidates rc1, rc2 and rc3
2009-11-16 snapshot-1.6b-20091116
- Update sflow collector with new tags
- Add router IP extension
- Add router ID (engine type/ID) extension
2009-09-30 snapshot-1.6b-20090930
- snapshot bugfix release
2009-11-0801 snapshot-1.6b-20090806
- Add srcmask and dstmask aggregation
- Add csv output mode. -o csv
- Fix some bugs of previous beta
- Add bidirectional aggregation of flows ( -b, -B )
- Add possibility to save aggregated flows into file ( -w )
Note: This results in a behaviour change for -w in combination
with aggragation )
- Extend -N ( do not scale numbers ) to all text output not just summary
- Make extension handling more robust for some moody IOSes.
- Remove header lines of -s stat, when using -q ( quiet )
Note: This results in a behaviour change for -N
- Remove -S option from nfdump ( legacy 1.4 compatibility )
- Make use of log (syslog) functions for nfprofile.
- Move log functions to util.c
2009-06-19 snapshot-1.6b-20090717
- Flow-tools converter updated - supports more common elements.
- Sflow collector updated. Supports more common elements.
- Add sampling to nfdump. Sampling is automatically recognised
in v5 undocumented header fields and in v9 option templates.
see nfcapd.1(1)
- Add @include option for filter to include more filter files.
- Add flexible aggregation comparable to Flexible Netflow (FNF)
- All new tags can be selected in -o fmt:... see nfdump(1)
- topN stat for all new tags is implemented
- Integrate developer code to read from pcap files into stable
- Update filter syntax for new tags
- Added more v9 tags for netflow v9.
The detailed tags are listed in nfcapd(1)
Adding new tags also extended the binary file format with
data block format 2, which is extension based. File format
for version <= 1.5.* ( Data block format 1 ) is read
transparently. Data block 2 are skipped by nfdump 1.5.7.
32bit but AS and interface numbers are supported.
- Add flexible storage option for nfcapd. To save disk space, the
data extensions to be stored in the data file are user selectable.
- Added option for multiple netflow stream to same port.
-n <Ident,IP,base_directory>
Example: -n router1,192.168.100.1,/var/nfdump/router1
So multiple -n options may be given at the command line
Old style syntax still works for compatibility, ( -I .. -l ... )
but then only one source is supported.
- Move to automake for building nfdump
- Switch scaling factor ( k, M, G ) from 1024 to 1000.
- Make nfdump fully 64bit compliant. ( 8bit data alignments and access )
2009-04-17 stable 1.5.8
- Fix daylight summer time bug, when guessing sub dirs. file access ( -M, -r )
- Bug fixes for 64bits CPUs
2008-02-22 stable-1,5.7
- Add icmp type/code decoding
- Add proper icmp v9 decoding
- Fix memory leaks in -e auto expire mode in nfcapd.
- Fix somee potential dead locks with file locking, when expiring
- Fix multicast bug in nfreplay
- Add hostname lookup for IP addresses in filter.
2007-10-15 stable-1.5.6
- Fix odd CISCO behaviour for ICMP type/code in src port.
- Add fast LZO1X-1 compression option (-z) for output file.
- Add lists for port in syntax -> port in [ 135 137 445]
- Add lists for AS syntax -> as in [ 1024 1025 ]
- Bug fix in filter for syntax 'src as and dst as'
2007-08-24 stable-1.5.5
- Fix nfprofile bug, nfprofile crashes when last opts line is not valid for
some reason.
- Fix potential hand for nfexpire, on empty flow directories.
2007-08-08 snapshot-20070808
- Idents may contain '-' in name.
- Fixed install bugs in Makefile.in and configure.in
- Installs now cleanly on Solaris
- Handle 4byte interface numbers in v9. Quick fix: 4bytes reduced to 2bytes.
- Fix aggregation bug in statistics.
- ftok(3) C library call replaced by more reliable own implementation.
Did result in error messages like "Another collector is already running"
- Fix minor bugs iin file range selction -R.
- Add recursive behaviour for -R <directory>
- New option -i can canche Ident descriptor in data files.
2007-03-12 snapshot-20070312
- Bug fix release of 20070306
2007-03-06 snapshot-20070306
- Fix bug in flist.c. Resulted in a coredump when using sub dirs and -R . ( all files )
- Fix minor bug in nfcapd.c.
- Extend nfprofile for alerting system of nfsen - special version of profiles
- Extend nfprofile for shadow profiles.
2007-08-10 snapshot-20070110
- Fix some compiler warnings, when compiled on a 64bit LINUX
- Fixes an sflow bug: IP address was printed in wrong direction. ( lower bits first )
- Add new IP addr taging option -T for easy parsing for nfsen lookups
- Add new IP list for massive address filtering:
syntax: ip in [ 12345 23456 3456 ....]
- Change nfprofile for channel based profiling. This breaks with old nfprofile
functionality.
- Remove space from ICMP type/code when followed by an IP address
2006-07-21 snapshot-20060809
- Make nfexpire ready for profile expiration
- Fix bug in nfrpofile. sub dir hierarchy not handled correctly.
2006-07-21 snapshot-20060721
- Add -N option for plain number output in summary line
2006-07-21 snapshot-20060721
- Do recursive file selection when a directory is given by -R
2006-06-14 snapshot-20060621
- Add srcas/dstas/proto aggregation.
Note: This changes the default aggregation behaviour, but gives more flexibility
- Add tos to element statistics list
2006-06-14 snapshot-20060614
- Add additional stat line at the end of output
- Add new binary nfexpire. Manages data expiry on time and/or size based limits
Includes new bookkeeping records in nfcapd. See nfexpire(1)
- Add ICMP type/code decoding in flow listing instead of dst port
- Add packet repeater in nfcapd/sfcapd. In addition, incoming UDP packets can
be directly forwarded to another IP address/Port. See new option -R
- Add sub directory hierarchies: Files can be stored into various sub dir levels
based on different time formats. see new option -S
- Some minor bug fixes.
- Code cleanup in nfcapd. better daemonize code and communication with launcher.
2006-04-xx v.1.5.1
Fix bug in nfdump.c: Writing anonymized flows to file did not work corretly
stdin input format now compatible with file format, therefore
'nfdump < file' works again as it did in nfdump 1.4.
Fix bug in nfcapd.c: Error handling not correct when receiving a non
recognized netflow packet. Resulted in an endless loop
2006-03-27 snapshot 1.5-20060327
Make all element statistics -s transport layer protocol
independant by default. Add :p to stat name ( e.g. srcip:p ) to
enable transport layer dependant statistics on request.
2006-03-20 snapshot 1.5-20060320
Fix bug in filter engine: 'not flags xyz' produces wrong results
when more than a single flag is specified.
Minor man page fixes.
2006-03-06 v1.5
Fix bug nfcapd. Laucher signaled too early. File not yet properly
closed.
2006-02-14 v1.5-beta-5
Add srcas, dstas, input and output interfaces in aggregated
output.
Fix IPv6 bug in filter: accept 1234:: address.
rename nfcapd.curent tmp file to nfcapd.curren.<pid>. Poorly
configured nfcapd processes may mess up themselves otherwise.
2006-02-02 v1.5-beta-4
Fix netflow v5 dPkts <-> dOctets collector bug.
Update pipe format to include more information
Allow AS number 0 in filter syntax.
Add some more boundary checking - netflow exporters aren't bug free either - sigh ..
2006-01-11 v1.5-beta-3
Fix isnumber incompatibility in grammar.y
Add 'if' statistics
2006-01-10 v1.5-beta-2
nf_common.c Fix bug in format parser.
Extended 'proto <protocol>' syntax to support all protocols
Change time format in summary line to ISO format
2005-12-20 v1.5-beta-1
*.* A lot of internal changes, not mentioned here. :(
nfdump Add subnet aggregation for option -A
A new syntax e.g. srcip4/24, dstip6/64 is supported for subnet wise aggregation.
example: traffic of a whole subnet -A srcip4/24 -s srcip/bytes
nfdump Add more stat element option. -s <stat> now supports:
srcip, dstip, ip, srcport, dstport, port, srcas, dstas, as, inif, outif, proto
nfdump Add -z. Suppress writing flows to data files. Only stat information is written.
nfprofile Used only be nfsen for upcoming shadow profiles. If you don't understand this
simply ignore it.
nfdump Add -q option to suppress header as well as stat information at the bottom
nfprofile for easier post processing with external programms.
nf_common.c Output format processsing rewritting for more flexibility. Besides standard
nfdump.c output formats line, long extended etc., user defined output formats are now
possible and can even be compiled into nfdump for easy access. See -o fmt:<format>
and nfdump.c around line 100.
*.* Integrate netflow v9 into nfdump. Only a subset of v9 is stored into
the data files, basically everything needed for nfdump to work as it did before.
This also includes IPv6 support for any nfdump options. CryptoPAN extended
to work with IPv6. IPv6 condensed output format for better readability.
Output formats available in long and condensed mode: e.g. line -> line6
extended -> extended6
*.* Replace binary data file format. Old format not flexible enough for
upcoming netflow v9/sflow data. *.stat files are gone. The same
information is now available under nfdump -I
New format about 5% larger in size, but faster for reading and writing.
speed gain eaten up by more complex processing - sigh ..
compat14 mode enables transparent reading of old style format.
nffile.[ch] now handles all data file stuff.
nfreplay Multicast enabled:
Add -j <join group>. Joins the specified multicast group ( v4 or v6 )
sending flows to this group.
nfreplay IPv6 enabled:
Add option -4 and -6 to force a specific protocol, otherwise
protocol is automatically selected according the hostname to send flows to.
Add -K key, to send data anonymized, using CryptoPAn
nfcapd Multicast enabled:
Add -j <join group>. Joins the specified multicast group ( v4 or v6 )
for listening.
nfcapd IPv6 enabled:
Add option -4 and -6 for IPv4 and IPv6. By default, listen on IPv4.
Option -b <host/IP> to bind for a specific host/IP address automatically
selects appropriate protocol.
nfnet.c All functions to setup network sockets for listening/sending are
put into this file.
2005-08-22 v1.4
- nfreplay: Bug fix sending flows.
- nfdump: Add CryptoPAn code to anonymize IP addresses. New option -K
- nfdump: Change time format in output to ISO 8601 compatible: e.g. 1981-04-05 14:30:30.100
- nfdump: Add scaling factor k,m,g to number in filter syntax: e.g. bytes > 1m
- nfdump: Create new output format extended with additional fields pps, bps and bpp
- nfdump: Rename output format extended to raw
- nfdump: More than one single flow element statistic ( -s ) is now possible
- nfdump: Add user defined sort order in flow element statistic
- nfdump: Flow element statistic can be ordered by more than one order in the same run
- nfdump: Add pps, bps and bpp fields in flow element statistics
- nfdump: Add more symbolic protocols ESP, AH, GRP and RVSP to filter syntax
- nfdump: Add duration, pps, bps and bpp to filter syntax
- nfdump: Make nfdump miliseconds aware. Older versions skipped msecs.
Binary nfdump file format changed due to this.
output formats changed, due to this.
- nfdump: Add interface in/out if <num> syntax to filter
- nfcapd: Add flow_sequence check. Reports missing flows now.
- nfcapd: Report statistics to syslog LOG_INFO when data file is rotated.
- ft2nfdump: Add ft2nfdump to read netflow data from flow-tools
2005-04-21 v1.3
- Add option -A for more flexible aggregation.
- Correct spelling errors :(
2005-03-04 v1.2.1
Bug fix release
- nfcapd: launcher subprocess may hang on Linux 2.6.x kernels.
Cleaned up interrupt handling.
- nfcapd: fix include order of socket.h and types.h in order to
compile cleanly under FreeBSD 4.x
- nfcapd: clean up syslog logging.
- nfdump: Multiple sources ( -M ) and sort flows ( -m ) with
-c <limit> did not list the correct flows.
- nfprofile: Profiling with multiple sources may produce incorrect
profiles.
2004-12-20 v1.2
- nfcapd handles transparent v5 and v7 flows. v7 gets converted into v5
- nfcapd can execute any command at the end of interval. New option -x
- nfdump Extended filter syntax for flags, to, bytes and packets
- Rearrange output formats in nfdump: new switch -o, remove switch -E
output formats: 'line', 'long', 'extended' and 'pipe'
- More flexible statistic handling in nfdump: cleanup ugly -s -s -s
syntax. Replaced by -s <stat> option. New statistics for Port and AS.
2004-09-20 v 1.1
First public Version.