Не начисляется услуга "входящий трафик" (на самом деле интересует только внешний).
# NOTES:
# * "input-only" directive must be supported by kernel.
# Probably, you were noticed about it during the compilation process
# if it was not supported.
# FreeBSD 3.x and elder kernels do not support this feature.
# * ULOG packet source (interface ulog) is supported under
# Linux >= 2.4.18-pre8.
# You should configure iptables to dump the packet stream
# into the appropriate group, i.e.:
# iptables -A OUTPUT -j ULOG --ulog-nlgroup <group>
# Given ULOG groups will be OR'ed together.
# * A wildcard (*) may be specified as part of an interface name.
#
interface eth0 promisc;
interface eth1 promisc;
interface eth2 promisc;
interface ppp*;
#
# aggregate <ip>/<masklen> strip <maskbits> ;
#
# Aggregate addresses from the specified network (<ip>/<masklen>),
# by AND'ing with specified mask (<maskbits>).
#
#
aggregate 192.168.0.0/16 strip 32; /* Don't aggregate internal range */
aggregate 10.100.15.0/24 strip 32;
aggregate 10.100.16.0/24 strip 32;
aggregate 10.100.17.0/24 strip 32;
aggregate 0.0.0.0/0 strip 24; /* Aggregate external networks */
#
# aggregate <port_range_start>[-<port_range_end>] into <port> ;
#
# Aggregate port numbers. Meaningful only if capture-ports is enabled.
#
aggregate 1024-65535 into 65535; /* Aggregate wildly */
aggregate 3128-3128 into 3128; /* Protect these ports */
aggregate 25-25 into 25;
aggregate 7777-7777 into 7777;
aggregate 110-100 into 110;
aggregate 80-80 into 80;
aggregate 150-1023 into 1023; /* General low range */
##########################
# NetFlow EXPORT OPTIONS #
##########################
#
# Enable Cisco NetFlow export method.
# NetFlow uses UDP to feed flow information to the receiver.
# If the destination is not specified, NetFlow is disabled.
#
netflow export destination 127.0.0.1 2001;
netflow export version 5; # NetFlow export format version {1|5}
netflow timeout active 1; # Timeout when flow is active, in minutes
netflow timeout inactive 15; # Flow inactivity timeout, in seconds
netflow engine-type 73; # v5 engine_type; 73='I' for "IPCAD"
netflow engine-id 1; # Useful to differentiate multiple ipcads.
# The following option is enabled by the "netflow-sampled" interface flag.
#netflow sampling-mode packet-interval 10; # 1 out of 10 packets accounted
# DO NOT ENABLE THIS UNLESS YOU KNOW WHAT ARE YOU DOING.
#
# NetFlow protocol exports an SNMP id instead of the interface name
# (i.e., "eth0", "ppp32"). The following statements options define
# mapping between the interface names and a set of "SNMP identifiers".
#
netflow ifclass eth mapto 0-99; # i.e., "eth1"->1, "eth3"->3
netflow ifclass ppp mapto 100-199; # i.e., "ppp32"->532, "ppp7"->507
netflow ifclass gre mapto 200-299;
######################
# RSH SERVER OPTIONS #
######################
#
# Enable RSH Server:
#
# rsh {enable|yes|on|disable|no|off} [at <listen_ip>];
#
# If "at <listen_ip>" omitted, rsh server listens on IP address 0.0.0.0,
# which may be undesirable.
#
rsh enable at 127.0.0.1;
#
# RSH access rules:
#
# rsh [<user>@]<host_addr> {admin|backup|[default]|view-only|deny} ;
#
rsh root@127.0.0.1 admin;
rsh root@127.0.0.1 backup;
rsh root@127.0.0.1;
rsh 127.0.0.1 view-only;
# Keep IP packet time to live reasonably low to avoid remote attacks.
# (The rsh client must reside no more than three hops away from the
# router running ipcad.)
rsh ttl = 3;
# Set rsh timeout for the same purpose.
rsh timeout = 30;
#
# Dump active IP accounting table to this file on exit and read on startup.
# (read about -s and -r options in ipcad(8) manual page)
# NOTE: This setting has no effect on NetFlow operation. The flow cache
# contents are flushed to the collector upon ipcad termination.
#
dumpfile = ipcad.dump; # The file is inside chroot(), see below...
#################
# OTHER OPTIONS #
#################
#
# Chroot to this directory before processing.
#
# Of course, you could disable chroot()'ing by commenting it out,
# but it is not recommended, so I left this confusing default
# to encourage you to change it.
#
chroot = /var/log/ipcad;
#
# File to keep getpid() in it. ipcad will also hold a lock.
#
# WARNING: Pidfile is created AFTER chroot()'ing, so if you're using
# chroot statement above, make sure the path to the pidfile exists
# inside chrooted environment.
#
pidfile = ipcad.pid;
#
# UID/GID privileges dropping
# Please note: RSH service will be UNAVAILABLE when uid is not zero.
# Use it only when you know what are you doing (i.e., NetFlow without RSH).
#
# uid = 65534;
# gid = 65534;
#
# Few useful settings.
#
#
# Memory usage limit for storing per-stream entries.
#
# memory_limit = <number>[{k|m|e}] ;
# Where k, m and g are for kilobytes, megabytes or table "entries".
#
memory_limit = 1m;
Заранее благодарен за помощь.
Вход
Регистрация
FAQ
Поиск
