$Revision: 1.12 $

		ipcad - IP accounting daemon README


OVERVIEW:

	IPCAD stands for IP Cisco Accounting Daemon. It runs in background and
listens traffic on the specified interfaces. ipcad uses raw BPF devices
(/dev/bpf*) or PCAP library (pcap(3)).

	Any interface may be put into promiscuous mode. This enables listening
for the packets which are not destined for this host and thus ipcad will
count and display all the traffic within the local network.
Note that the interface might be in promiscuous mode for some other reason.

	Any interface may be configured as the "incoming-only" (if supported by
system, see below), so all packets sent using this interface will be ignored.
By default, all packets are counted: input and output. This is opposite to the
Cisco's "ip accounting output-only" scheme, which counts only outgoing packets
on the interface. So, beware! Again: this feature must be supported by kernel.


ACCOUNTING:

	Well, we put ipcad into background with '-d' and it silently counts
the traffic. How we can access the state?

	First, it can be viewed by sending the signal, SIGINT, to the ipcad
process. The statistics table, compatible with Cisco "show ip accounting"
table, will be displayed on console. If ipcad is not in the daemon mode, you
can just press Ctrl+C to see the table.
	Second, there is built-in rsh daemon. Configuration file contains an
access filter: who and from where can access the statistics. RSH behavior
is fully compatible with standart rsh protocol (rshd(8)), with exception
that it NEVER checks the /etc/hosts.allow or .rhosts.

	Supported rsh commands simulating Cisco behavior are:

		show ip accounting
		show ip accounting checkpoint
		clear ip accounting
		clear ip accounting checkpoint
		show interface <iface>

	Of course, there are an abbs too:

		sh ip acco
		sh ip acco che
		cle ip acco
		cle ip acco che
		sh in <iface>

	Other supported commands:

		help	# Built in help
		stat	# Print some statistics apart from table
		dump [<pathname>] # Dump the table into the specified file
		restore [<path>]  # Restore the table from the specified file
		import  [<path>]  # Import (add) entries from the specified file
		shutdown # Shutdown ipcad

	Full list of supported commands can be accessed by issuing a
"rsh localhost help" command when ipcad is running.

	Configurable features are explained in sample ipcad.conf included
in this distribution.


COMMAND LINE OPTIONS:

	There are few command line options recognized by ipcad. There are:

		-h:     this help page
		-d:     become daemon (otherwise, work in foreground)
		-c:     specify configuration file
		-r:     import the dump file on startup
		-s:     dump the active table on exit


	Typical start string may look like this

		ipcad -rds

	(Import previously saved state table, become daemon, and save
	state on exit).


-- 
Lev Walkin, LMW28
vlm@spelio.net.ru
www.spelio.net.ru
