NAME

       nacctd - network accounting daemon

SYNOPSIS

       nacctd [-dD] [-c filename]

DESCRIPTION

       The  network  accounting  daemon  logs network traffic in a format suitable for generating
       billing information or  usage  statistics.   nacctd  listens  on  network  interfaces  and
       periodically writes information to a log file.

       nacctd is configured by editing its configuration file, /etc/nacctd.conf.

OPTIONS

       -d     This will let nacctd run in debug mode

       -D     This  will  make  nacctd  not  to  detach as a daemon, suitable for running it from
              inittab.

       -c     configfile Specify the path of an alternative config file.

CONFIGURATION FILE OPTIONS

       flush <n>
              Flush every n seconds. This gives the interval in seconds when the accumulated data
              is flushed to the output file. Typically set to 300 (five minutes).

       fdelay <n>
              This  defines  after  how  many  seconds  of inactivity a certain record of traffic
              information may be written out. This helps making the log files smaller since  only
              one  output  record  will  be  generated  for related traffic.  Typically set to 60
              seconds.

       file <f>
              Specifies the main output file for the daemon to log network traffic to.

       dumpfile <f>
              Specifies a file to dump data to that is not yet written to the main  output  file.
              This  is to prevent data loss should a crash occur.  On startup an existing file of
              this name will be moved to <f>.o

       notdev <interface>
              Don't log entries for this interface.

       device <interface>
              Specifies a network interface to put into promiscuous mode.

       iflimit <interface>
              Log only packets on this interface.  Mutually exclusive with hostlimit.

       ignoremask <netmask>
              Specifies a netmask (in dotted quad format) for which  traffic  is  ignored.   This
              allows traffic on the local LAN to be excluded.

       ignorenet <network> <netmask>
              Ignore  traffic  on this network. Ignoring a net with ignorenet is not as efficient
              as ignoremask. Thus you should  exclude  your  local  network  with  ignoremask  in
              preference to ignorenet.

       masqif <ipaddr>
              Specifies  an  ip number we are masquerading as.  This re-maps ip/port for incoming
              connections (e.g. FTP-data) to ip/port of the masqueraded destination.

       debug <n>
              Sets the debugging level to <n>.

       headers <interface-type> <data-start> <type-field>
              Defines where the real data starts for each type of interface.  <interface-type> is
              one  of  eth, lo, plip, isdn etc.  <data-start> is the offset in bytes to the start
              of the real data.  <type-field> is the offset of the type field in bytes, or a 0 if
              there  is no type field.  If SLIP or PPP devices are specified here, association of
              dynamic ip addresses with usernames won't work (see dynamicip below).

       dynamicip <dir>
              Specifies a directory to get username information from, where users are logged into
              ppp  or  slip  accounts  and  assigned  dynamic ip addresses.  The directory should
              contain a file for each logged in user, where the filename is their IP address, and
              the  file contains their username.  Typically, these files will be created by ip-up
              scripts.

       dynamicnet <network> <netmask>
              Specifies the network the slip/ppp dynamic ips are assigned from.

       exclude-name-lookup <network> <netmask>
              Specifies a (sub)net to exclude from dynamic ip name lookup.

       hostlimit <ipaddr>
              Log only packets to/from this host.  This  may  be  specified  multiple  times  for
              multiple hosts.  This option is mutually exclusive with iflimit.

       disable <n>
              Don't include field <n> in the output format.

       dontignore <network> <netmask>
              Don't  ignore  hosts  on  the  specified  (sub)net  that  would otherwise have been
              excluded by an ignorenet statement.  This can be a  useful  to  account  for  proxy
              traffic by specifying the proxy servers' subnet.

       line  <interface> <device>
              Specifies  fixed  mapping of slip/ppp interface names to tty devices.  This is used
              to assign traffic to a user if nacctd runs on the ppp/slip server and the  relation
              between network interface and serial line is fixed.  This option is obsolete.

OUTPUT FILE FORMAT

       The  output file consists of lines with up to 10 fields, or less if the configuration file
       disables one or more fields.

       timestamp protocol src-addr src-port dst-addr dst-port count size user interface

       timestamp
              Time in seconds past the epoch (standard UNIX time format)

       protocol
              IP protocol

       count  count of packets

       size   size of data

       user   associated user in case of a slip/ppp link, this will always be "unknown" for other
              interfaces.

       If  the  type is an ICMP message, field 4 is the ICMP message type and field 6 is the ICMP
       message code.

       Please note that for forwarded packets there will be  one  line  for  EACH  interface  the
       packet passed. So if you are running this on your slip-server you will get all the traffic
       over the slip interfaces TWICE, once for the sl* devices and once for the eth* device. The
       same  goes for ppp and generally for all forwarded traffic.  You can specify with 'notdev'
       entries which interfaces you don't want to see in the log.

FILES

       /etc/nacctd.conf
              Configuration file

       /var/log/net-acct
              Default location for the main output file

       /var/log/net-acct-dump
              Default location for the dump of data not yet written to the main file.

SEE ALSO

       /usr/share/doc/net-acct/*, tcpdump(8), trafshow(1).

CAVEATS

       This manual page is incomplete, and possibly inaccurate.

AUTHORS

       Ulrich Callmeier

       Richard Clark <rclark@ethos.co.nz>

       This manual page was written by Alex King <alex@king.net.nz>,  for  the  Debian  GNU/Linux
       system, using material from the original documentation.

                                           16 Dec 2001                                  nacctd(8)