IPFM.CONF(5)

NAME
ipfm.conf - IP Flow Meter configuration file

DESCRIPTION
ipfm.conf is ipfm(8) configuration file. A hash mark (``#'') indicates that the end of the line is a comment and it will be ignored. The configuration rules will be interpreted from the end, and the first matching rule will be used, unless specified here. IPFM uses local and global variables, so it can manage muliple logs (different time delay, different hosts, different log filemane ...) in the same time.

GLOBLAL VARIABLES

  NETWORK DEVICE
Syntax : DEVICE <device-name>

<device-name>
    is the device on witch ipfm will log packets.

  NEW LOG
Syntax : NEWLOG This creates a new log entry, where you can define new local variables.

LOCAL VARIABLES

  HOSTS TO LOG
ipfm logs only specified hosts. Syntax: LOG [[NONE|FROM|TO|BOTH] <host>] [[NOT] WITH <host>]

NONE
    do not log anything from or to this <host>

FROM
    do log packets from this <host>

TO  do log packets to this <host>

BOTH
    (default) do log packets from and to this <host>

<host> can be :
    x.x.x.x : an IP. x.x.x.x/x.x.x.x : an IP followed by a subnet mask.

WITH
    specifies if the packet is ignored (NOT WITH) or logged (WITH), in function of the second IP present in the packet.

Examples :
    LOG 10.10.10.0/255.255.255.0 NOT WITH 10.10.10.1
     will log any packets from or to hosts in subnet 10.10.10.0/255.255.255.0, except packets involving host 10.10.10.1 . LOG WITH 10.10.10.23
     will log any packets in relation with host 10.10.10.23 LOG
     will log everything.

  OUTPUT TIME DELAY
ipfm outputs its statistics every fixed period. Syntax: TIME <time>

<time> is composed of :
     <number> second
     <number> minute
     <number> hour
     <number> day

Example:
    TIME 1 hour 30 minute 12 second

  LOG FILENAME
Every delay, ipfm writes its output into a file, which name is specified by the rule FILEMANE Syntax: FILENAME <filemask>

<filemask>
    is a string that is parsed using strftime(3) syntax.

Default FILENAME is /var/log/ipfm/%d-%b.%H-%M
    NOTE : The file will be overwritten without any check.

  REVERSE DNS
You can use or desactivate reverse DNS in the output file. Syntax : [RESOLVE|NORESOLVE]

Default is RESOLVE

  SORT OUTPUT FILE
ipfm can sort output file depending on IN, OUT or TOTAL. Syntax : SORT IN|OUT|TOTAL

Default is to sort nothing.

SEE ALSO
strftime(3), ipfm(8)

AUTHORS
 Robert CHERAMY <tibob@via.ecp.fr>
 Andres KRAPF <dae@via.ecp.fr>