NAME
nacctd - network accounting daemon
SYNOPSIS
nacctd [-dD] [-c filename]
DESCRIPTION
The network accounting daemon logs network traffic in a format suitable
for generating billing information or usage statistics. nacctd listens
on network interfaces and periodically writes information to a log
file.
nacctd is configured by editing its configuration file,
/etc/nacctd.conf.
OPTIONS
-d This will let nacctd run in debug mode
-D This will make nacctd not to detach as a daemon, suitable for
running it from inittab.
-c configfile Specify the path of an alternative config file.
CONFIGURATION FILE OPTIONS
flush <n>
Flush every n seconds. This gives the interval in seconds when
the accumulated data is flushed to the output file. Typically
set to 300 (five minutes).
fdelay <n>
This defines after how many seconds of inactivity a certain
record of traffic information may be written out. This helps
making the log files smaller since only one output record will
be generated for related traffic. Typically set to 60 seconds.
file <f>
Specifies the main output file for the daemon to log network
traffic to.
dumpfile <f>
Specifies a file to dump data to that is not yet written to the
main output file. This is to prevent data loss should a crash
occur. On startup an existing file of this name will be moved
to <f>.o
notdev <interface>
Don’t log entries for this interface.
device <interface>
Specifies a network interface to put into promiscuous mode.
iflimit <interface>
Log only packets on this interface. Mutually exclusive with
hostlimit.
ignoremask <netmask>
Specifies a netmask (in dotted quad format) for which traffic is
ignored. This allows traffic on the local LAN to be excluded.
ignorenet <network> <netmask>
Ignore traffic on this network. Ignoring a net with ignorenet is
not as efficient as ignoremask. Thus you should exclude your
local network with ignoremask in preference to ignorenet.
masqif <ipaddr>
Specifies an ip number we are masquerading as. This re-maps
ip/port for incoming connections (e.g. FTP-data) to ip/port of
the masqueraded destination.
debug <n>
Sets the debugging level to <n>.
headers <interface-type> <data-start> <type-field>
Defines where the real data starts for each type of interface.
<interface-type> is one of eth, lo, plip, isdn etc. <data-
start> is the offset in bytes to the start of the real data.
<type-field> is the offset of the type field in bytes, or a 0 if
there is no type field. If SLIP or PPP devices are specified
here, association of dynamic ip addresses with usernames won’t
work (see dynamicip below).
dynamicip <dir>
Specifies a directory to get username information from, where
users are logged into ppp or slip accounts and assigned dynamic
ip addresses. The directory should contain a file for each
logged in user, where the filename is their IP address, and the
file contains their username. Typically, these files will be
created by ip-up scripts.
dynamicnet <network> <netmask>
Specifies the network the slip/ppp dynamic ips are assigned
from.
exclude-name-lookup <network> <netmask>
Specifies a (sub)net to exclude from dynamic ip name lookup.
hostlimit <ipaddr>
Log only packets to/from this host. This may be specified
multiple times for multiple hosts. This option is mutually
exclusive with iflimit.
disable <n>
Don’t include field <n> in the output format.
dontignore <network> <netmask>
Don’t ignore hosts on the specified (sub)net that would
otherwise have been excluded by an ignorenet statement. This
can be a useful to account for proxy traffic by specifying the
proxy servers’ subnet.
line <interface> <device>
Specifies fixed mapping of slip/ppp interface names to tty
devices. This is used to assign traffic to a user if nacctd
runs on the ppp/slip server and the relation between network
interface and serial line is fixed. This option is obsolete.
OUTPUT FILE FORMAT
The output file consists of lines with up to 10 fields, or less if the
configuration file disables one or more fields.
timestamp protocol src-addr src-port dst-addr dst-port count size user
interface
timestamp
Time in seconds past the epoch (standard UNIX time format)
protocol
IP protocol
count count of packets
size size of data
user associated user in case of a slip/ppp link, this will always be
"unknown" for other interfaces.
If the type is an ICMP message, field 4 is the ICMP message type and
field 6 is the ICMP message code.
Please note that for forwarded packets there will be one line for EACH
interface the packet passed. So if you are running this on your slip-
server you will get all the traffic over the slip interfaces TWICE,
once for the sl* devices and once for the eth* device. The same goes
for ppp and generally for all forwarded traffic. You can specify with
’notdev’ entries which interfaces you don’t want to see in the log.
FILES
/etc/nacctd.conf
Configuration file
/var/log/net-acct
Default location for the main output file
/var/log/net-acct-dump
Default location for the dump of data not yet written to the
main file.
SEE ALSO
/usr/share/doc/net-acct/*, tcpdump(8), trafshow(1).
CAVEATS
This manual page is incomplete, and possibly inaccurate.
AUTHORS
Ulrich Callmeier
Richard Clark <rclark@ethos.co.nz>
This manual page was written by Alex King <alex@king.net.nz>, for the
Debian GNU/Linux system, using material from the original
documentation.
16 Dec 2001 nacctd(8)