{"id":17723781,"url":"https://github.com/ncw/go-nflog-acctd","last_synced_at":"2025-05-07T08:25:14.022Z","repository":{"id":8513838,"uuid":"10126501","full_name":"ncw/go-nflog-acctd","owner":"ncw","description":"IP accounting using NFLOG under Linux iptables","archived":false,"fork":false,"pushed_at":"2018-05-31T10:17:01.000Z","size":41,"stargazers_count":53,"open_issues_count":0,"forks_count":7,"subscribers_count":9,"default_branch":"master","last_synced_at":"2024-06-19T00:16:20.192Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ncw.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-05-17T15:37:14.000Z","updated_at":"2022-04-25T14:22:23.000Z","dependencies_parsed_at":"2022-09-26T22:01:36.457Z","dependency_job_id":null,"html_url":"https://github.com/ncw/go-nflog-acctd","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ncw%2Fgo-nflog-acctd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ncw%2Fgo-nflog-acctd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ncw%2Fgo-nflog-acctd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ncw%2Fgo-nflog-acctd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ncw","download_url":"https://codeload.github.com/ncw/go-nflog-acctd/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252840755,"owners_count":21812365,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-25T15:44:00.869Z","updated_at":"2025-05-07T08:25:13.999Z","avatar_url":"https://github.com/ncw.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"% go-nflog-acctd(1) User Manual\n% Nick Craig-Wood\n% May 17, 2013\n\nGo NFLOG accounting\n===================\n\nThis is a program to do IP accounting using NFLOG under Linux iptables.\n\nTo use it you'll need to add some NFLOG rules into your iptables (and\nip6tables) and configure go-nflog-acctd to read them.  It will\nperiodically dump .csv files for you to analyse.\n\nTo monitor IPv4 to and from this host you might use\n\n    iptables -A OUTPUT -j NFLOG --nflog-group 4 --nflog-range 20 --nflog-threshold 50 --nflog-prefix \"IPv4out\"\n    iptables -A INPUT -j NFLOG --nflog-group 5 --nflog-range 20 --nflog-threshold 50 --nflog-prefix \"IPv4in\"\n\nAnd to monitor IPv6 to and from this host you might use\n\n    ip6tables -A OUTPUT -j NFLOG --nflog-group 6 --nflog-range 40 --nflog-threshold 50 --nflog-prefix \"IPv6out\"\n    ip6tables -A INPUT -j NFLOG --nflog-group 7 --nflog-range 40 --nflog-threshold 50 --nflog-prefix \"IPv6in\"\n\nYou then configure go-nflog-acctd using the nflog groups you used in the iptables commands, eg\n\n    sudo ./go-nflog-acctd  -interval 1h -ip4-dst-group=4 -ip4-src-group=5 -ip6-dst-group=6 -ip6-src-group=7\n\nNote that go-nflog-acctd needs to run as root.\n\ngo-nflog-acct doesn't daemonize itself - you'll need to run it under supervisord or similar.\n\nUsage\n=====\n\n    go-nflog-acctd [flags]\n\nImportant flags\n\nThe NFlog IDs to monitor.  These must match the ones in your iptables rules\n\n    -ip4-dst-group=0: NFLog Group to read IPv4 packets and account the destination address\n    -ip4-src-group=0: NFLog Group to read IPv4 packets and account the source address\n    -ip6-dst-group=0: NFLog Group to read IPv6 packets and account the destination address\n    -ip6-src-group=0: NFLog Group to read IPv6 packets and account the source address\n\nBy default IPv4 addresses are not aggregated and IPv6 addresses are\naggregated to /64.  Use -ip4-prefix-length and -ip6-prefix-length to\ncontrol this.\n\n    -ip4-prefix-length=32: Size of the IPv4 prefix to account to, default is /32\n    -ip6-prefix-length=64: Size of the IPv6 prefix to account to, default is /64\n\nControl where and how often the stats are written\n\n    -log-directory=\"/var/log/accounting\": Directory to write accounting files to.\n    -interval=5m0s: Interval to log stats\n\nMisc settings\n\n    -cpus=0: Number of CPUs to use - default 0 is all of them\n    -syslog=false: Use Syslog for logging\n    -cpuprofile=\"\": Write cpu profile to file\n    -debug=false: Print every single packet that arrives\n\nOutput format\n-------------\n\nThe bandwidth logs are written in CSV format to /var/log/accounting by default\n\nThey are named by \"start of period-end-of-period.csv\" eg\n\"2013-02-11-150000_2013-02-11-160000.csv\"\n\nThe logs always start with a header row then data.  IP addresses can\nbe IPv4 or IPv6 addresses, either of which can have been masked.\n\n    Time,IP,SourceBytes,SourcePackets,DestBytes,DestPackets\n    2013-02-11 15:00:00,2001:aaa:bbbb:ccc:dddd:eeee:f52:b974,53756,281,66277,245\n    2013-02-11 15:00:00,2001:aaa:bbbb:ccc:dddd:eeee:2af7:aa9e,532072,3078,1342504,3279\n    2013-02-11 15:00:00,192.168.0.22,76,1,76,1\n    2013-02-11 15:00:00,192.168.0.42,100372,762,10888,105\n    2013-02-11 15:00:00,192.168.0.26,76,1,76,1\n    2013-02-11 15:00:00,192.168.0.22,10396412,159611,260251871,257171\n    2013-02-11 15:00:00,2001:aaa:bbbb:ccc:dddd:eeee:1835:8103,7758,48,35987,47\n    2013-02-11 15:00:00,192.168.0.19,1168,13,1414,9\n    2013-02-11 15:00:00,2001:aaa:bbbb:ccc:dddd:eeee:7818:86a,1127817,9522,14265686,14061\n    2013-02-11 15:00:00,2001:aaa:bbbb:ccc:dddd:eeee:5eb7:5f2f,125213,989,1214213,1237\n\nBuild\n=====\n\nMake sure you have [libnetfilter_log](http://www.netfilter.org/projects/libnetfilter_log/) installed.\n\nOn Debian/Ubuntu install like this\n\n    sudo apt-get install libnetfilter-log-dev\n\nThen this to create the go-nflog-acctd binary.\n\n    go build\n\nLive Testing\n------------\n\nIn one window\n\n    sudo  ./go-nflog-acctd  -interval 10s -ip4-dst-group=4 -ip4-src-group=5 -ip6-dst-group=6 -ip6-src-group=7 -cpuprofile z.prof\n\nIn another window\n\n    sudo hping3 127.0.0.2 --syn -p 80 -s 53 --flood\n\nAnd a third use top to monitor the CPU usage\n\nCheck correctness\n-----------------\n\nIn one window\n\n    sudo  ./go-nflog-acctd  -interval 1h -ip4-dst-group=4 -ip4-src-group=5 -ip6-dst-group=6 -ip6-src-group=7\n\nIn another\n\n    sudo hping3 127.0.0.2 --syn -p 80 -s 53 --flood\n\nRun for a while\n\nStop the hping3\n\nStop the go-nflog-acctd\n\nCheck to see that the number of packets in the .csv is the same (give\nor take 1 or 2) as hping3 printed when it was quitted\n\nBenchmark\n---------\n\nUse this to do micro-optimisations on the packet handling code\n\n    go test -v -bench .\n\nLicense\n=======\n\nThis is free software under the terms of the MIT license (check the\nCOPYING file included in this package).\n\nContact and support\n===================\n\nThe project website is at:\n\n- https://github.com/ncw/go-nflog-acctd\n\nThere you can file bug reports, ask for help or contribute patches.\n\nAuthors\n=======\n\n- Nick Craig-Wood \u003cnick@craig-wood.com\u003e\n\nContributors\n------------\n\n- Your name goes here!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fncw%2Fgo-nflog-acctd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fncw%2Fgo-nflog-acctd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fncw%2Fgo-nflog-acctd/lists"}