pmacct

A 'cos' aggregation primitive has been implemented, providing support for 802.1p priority. TCP MD5 signatures are supported as part of the BGP daemon. In nfprobe and sfprobe, the concept of traffic direction has been introduced, and as a result [ns]fprobe_direction and [ns]fprobe_ifindex config directives have been implemented. Switch Extension Header support and Counter Samples for multiple interface features have been added in sfprobe. A number of bugfixes are included.

A 'tee' plugin is being introduced, and brings both NetFlow and sFlow replication capabilities. 'nfprobe' and 'sfprobe' plugins have support for exporting of the BGP next-hop information. The BGP daemon is now able to mark self-originated messages with a supplied IP precedence value. The 'print' plugin can now present results as Comma-Separated Values (CSV) in addition to formatted text. pmacctd has improved 802.1ad support. There are some bugfixes.

Support for input/output interfaces (SNMP indexes) and source/destination IP prefix masks has been introduced via additional aggregation primitives. A generic tunnel inspection infrastructure has been developed to benefit
both pmacctd and uacctd daemons: GTP, the GPRS tunneling protocol being the only supported protocol. Support for the MAC layer has been added for the Netlink/ULOG Linux packet capturing framework. A new 'nfprobe_source_ip' feature allows you to select the IPv4/IPv6 address to be used to export NetFlow
datagrams to the collector.

The "is_symmetric" aggregation primitive has been implemented and is aimed at easing detection of asymmetric traffic. Tagging is now possible on the following BGP primitives: src_local_pref, local_pref, src_comms, comms (match-any or match-all fashion), and src_peer_as. Documentation and examples have been updated; various fixes are also included.

New BGP primitives have been introduced: src_as_path, src_std_comm, src_ext_comm, src_local_pref, and src_med. A new 'bgp_follow_nexthop' feature is aimed at networks not running MPLS, where hop-by-hop routing is in place. A new 'bgp_peer_as_skip_subas' feature allows this release to return the first ASN that is not part of a BGP confederation when computing peer_src_as and peer_dst_as primitives. The ULOG accounting daemon (uacctd) introduces support for input and output interfaces. A new feature is added to set source/destination ASNs, part of NetFlow/sFlow exports, to the peer AS rather than origin AS.