                                 
                              IPAcco
              IP Accounting Collector and Visualizer
                         for Cisco Routers
                            Version 0.2
                                 
                        General Information

 0. Important note:
 
If  you  are upgrading from the previous version of IPAcco, please
read the release notes in the file RELNOTES.txt (or  RELNOTES.html
or  RELNOTES.pdf). There are some changes in this version that may
make you IPAcco installation non-functioning if you ignore them!

 1. Overview
 
IPAcco  is a free software package that helps a network  admin  to
collect,  visualize and analyze IP accounting data from the  Cisco
routers.  Cisco  routers themselves are capable of  collecting  IP
accounting  information  - i.e. an unordered  set  of  IP  source-
destination   pairs  along  with  a  byte  and   packet   counters
corresponding to all network traffic flows that passed through the
router's interfaces. This data can be a useful source for  various
analysis procedures and billing systems but by itself, in its  raw
form it is rather difficult to read and understand. In addition, a
router  cannot  keep  a  lot of data - its memory  is  needed  for
purposes  other than remembering what traffic, from  what  sources
and where it forwarded two month ago.

In  order to extract something useful from IP accounting  data,  a
network admin should unload in some way this data from the router,
collect  it  in some ordered storage and at last have  a  tool  to
retrieve  from  this storage exactly what he needs.  That's  where
IPAcco  can  help.  It  does exactly those  things:  downloads  IP
accounting data from the router using a network connection, stores
it  in the MySQL database and provides Web access to the collected
data, presenting it in a convenient graphical form and allows user
to specify various criteria for data selection.

IPAcco  keeps its data in four sets of database tables. First,  it
places  the  data downloaded from the router to the "Day"  set  of
tables.  Then, as time go, IPAcco gets data from the "Day" tables,
squeezes  it  summarizing  by bigger  time  periods  than  it  was
originally gathered and moves it to the "Week" tables, cutting the
data  from the oldest readouts. Similarly, it moves data from  the
"Week"  tables to the "Month" ones and, finally, from the  "Month"
to the "Year" tables.

Obviously, the idea is taken from MRTG. This mechanism lets IPAcco
database  not  grow after the initial period of data  accumulation
and growth is finished.

 2. System Requirements
 
IPAcco  should work on any system (Windows, Linux, Unix), provided
the following components are available:

1. PHP-compatible  Web-server. Apache and IIS  would  definitely
 work and probably many others will work too.

2. PHP  server-side scripting engine version 4.3.2 or better.  I
   tested IPAcco with PHP 4.3.4 through 4.3.10. If you have not  PHP
   you may get it from www.php.net.

3. MySQL database server version 4.x or better with InnoDB
   support. I tested IPAcco with MySQL 4.0.15, 4.0.17 and 4.1.7.
   InnoDB is required because the script that downloads data from the
   router to the database, which is a part of IPAcco package, makes
   intensive use of transactions when it repacks data from  "Day"
   tables to "Week" ones, from "Week" to "Month" and so on. Probably
   any MySQL storage engine that support transactions (i.e. BDB and
   NDB) would work, but I tested IPAcco with InnoDB only. MyISAM
   definitely will not work. MySQL can be obtained from www.mysql.com.

4. TCL scripting language interpreter with "mysqltcl" package
   installed (MySQL client driver for TCL) for data collection (i.e.
   downloading from the router to the database). I don't know exactly
   what TCL and mysqltcl versions are and what are not compatible
   with IPAcco. I tested IPAcco with TCL 8.3.5 under Linux,
   ActiveState ActiveTCL 8.4.5 through 8.4.9 under Windows and with
   mysqltcl 2.50 under both systems. You may get TCL from
   www.activestate.com or from www.tcl.tk and mysqltcl from
   www.xdobry.de/mysqltcl.

5. "rsh" command available on the same machine as TCL and
   mysqltcl. This command is a part of RCMD, a classic Unix remote
   access protocol (Remote CoMmanD). It naturally presents in all
   Unix/Linux systems and also in systems based on Windows NT, i.e.
   Windows NT itself, Windows 2000 and Windows XP. Unfortunately,
   there is not "rsh" command in Windows 9x, so such systems cannot
   be used for data collection.

6. A good CSS-capable GUI web-browser for data observation and
   analysis. Java support is not required and requirements for
   Javascript support are so minimalistic that virtually any modern
   GUI browser will suffice. But a good-quality HTML and CSS
   rendering capability is highly recommended. I prefer Internet
   Explorer and Mozilla Firefox, but you may try a browser of your
   choice in hope that it will not cripple IPAcco output too bad. :-)

7. An IP accounting-capable router itself. All Cisco routers and
   IOS versions I know support IP-accounting.

Note  that if you have a working Linux box, built upon one of  the
popular modern Linux distributions, you probably already have  all
you  need  to run IPAcco. And if you miss any of these components,
you may get it for free for any of the listed platforms.

All  these components may be installed on the same machine  or  on
the  four separate hosts, either Linux/Unix or Windows-based.  The
only  recommendation is to hold the database, the  web-server  and
the  data  collector script on the same machine to reduce  network
traffic.

After  all, one question remains. If you have all things mentioned
above  installed and working, will IPAcco work on you  system  and
will  it  work  well?  Or, in other words,  how  fast  must  be  a
server(s) to run IPAcco? How much space will be required  for  the
database? And so on.

To  be  honest, I don't know. It depends on the volume of  traffic
traversing your router. I don't know how scalable IPAcco is.  With
my Cisco 3660 routers with about two dozens various interfaces and
with  maximum traffic rate value about 150,000 bytes/sec (5 minute
average), with data sampling frequency one time per 5 minutes, the
database  occupies about 1270 Megabytes of disk space after  about
one year of data collecting. Now it keeps growing and I expect its
final  size  will be about 1 Gigabyte after 2 years  of  intensive
growth. Then the growth is expected to slow down deeply, since the
"year" tables will start to be cut daily.

It  takes about 90 seconds from the two-processor 1 GHz PIII  Xeon
server  to  build a full-time (2 days + 2 weeks +  2  months  +  1
year), full-traffic graph from this database and to transfer it to
the browser. Effectively this operation requires summarizing about
570  Megabytes of data. And in the same time the server  works  as
Windows  2000  PDC  and performs some other,  not  very  intensive
tasks.  I  believe  this result is good enough for  more  or  less
comfortable on-line data analysis.

If  you  have a much more powerful router with much greater volume
of  traffic you probably will need more powerful server with  more
disk  space.  Or perhaps, setting data sampling frequency  to  the
lower value will solve the problem.

 3. Getting Started
 
Read a brief installation guide contained in the file INSTALL.txt,
INSTALL.pdf  or  INSTALL.html. Follow the  instructions  you  find
there.
