# e-mail:info@netup.ru
# Copyright (c) 2001-2004 NetUP Inc. <info@netup.ru>. All rights reserved.
# This project is a part of NetUP UTM - Universal Billing System
# For more information please visit www.netup.biz

NetUP Data Stream Accounting Daemon (ndsad)

Configuration file (ndsad.cfg)

The file may contain empty strings. A line which starts with a # is treated as a comment and will be ignored.

Syntax:

<keyword> <value>


Network devices with a different index are called "family". For example, eth family includes the devices: eth0, eth1, eth12, etc.

The parameter value can be one inseparable word (except heap and hash parameters). When there are several parameter values (e.g., listening on several devices), define the parameter several times:

force rl0
force fxp0

Keywords:

ip

Destination address. Traffic data will be sent to this address. Default value: ip 127.0.0.1.
Example: ip 10.0.0.1.


port

Destination port. See also ip. Default value: port 9996.
Example: port 10001.


force

Specifies the interfaces to listen on. This keyword has a higher priority than "ignore" and "dummy".
Example: force eth0.


force_family

Specifies the device family to listen on. This keyword has a higher priority than "ignore" and "dummy". 
Example: force_family ppp


nf_lifetime

Session length in seconds. When the session length exceeds the defined value, NetFlow record with the data on captured traffic will be generated. At the end of the session, one more record will be generated. Default value: 1800 sec.


ignore

The string indicates that the specified device will not be processed. See also "force".
Example: ignore eth0.


Note: On Win32 you can also use the IP address instead of interface names with "force" and "ignore" keywords.


Example for Win32:
force \Device\NPF_{A07050FE-62B3-40AF-B6D2-658701A56089}
ignore 192.168.1.1
force 192.168.0.1


dummy

All devices in this family will not be processed. If set to "all", no interfaces will be listened on, except those explicitly defined by "force".
Example: dummy eth.


promisc

Put interface into promiscuous mode. 
Example: promisc ex0.


filter 

Selects which packets will be captured. See tcpdump(1) for syntax description.
Example: filter fxp0 not port 135
Example: filter fxp0 net 10.0.0.0/24 and not port 135


hash

Hash size for device family. This value should be a degree of two. Otherwise, memory will be used ineffectively. Default value: hash all 128.
Example: hash lo 64.


heap

Buffer size. Maximum amount of memory that may be busy, but not necessarily used. When required, memory is taken from that heap, and not from the system. Reasonable sizes increase the speed. Default value: heap 16384.
Example: heap 65536.


dump

Dump statistics to logfile at the specified interval (in seconds). Defining 0 will disable logging. Note: Sending SIGHUP will force the dump. Default value: dump 0.
Example: dump 5.


log

Path to logfile. If not set, stderr will be used. Default value: /netup/utm5/log/ndsad.log.
Example: log /var/log/ndsad.log.


config

Location of the configuration file. Default value: config /etc/ndsad.cfg.
Example: config /etc/ndsad.cfg.


Supported devices:

BSD: vlan, bfe, tun, ng, nv, lo, dc, fxp, pcn, rl, sf, sis, ste, tl, tx, vr, wb, xl, de, txp, vx, bge, em, gx, lge, nge, sk, ti, wx, cx, ed, el, ep, ie, is, le, ex, lnc, my, wi, an.
Linux: lo, eth, ppp.

Only Ethernet devices are supported by default on Win32.
Should you need to bill VPN-connections, download and install a more recent Winpcap version (http://winpcap.polito.it). V. 3.1beta3 currently supports PPP-interfaces.

