CNUPM(8)

NAME
cnupm - IP/IPv6 traffic collector

SYNOPSIS
cnupm [-dDekNOpPqV] [-a interval] [-A portrange [:port] [,...]] [-f family] [-F file] [-i interface] [-m maxentries] [-t dir] [-u user] [expression]

DESCRIPTION
The cnupm is an IP/IPv6 traffic collector daemon; it listens on a network interface for IP/IPv6 packets that match the boolean expression (see tcpdump(8) for more information) and collects the following statistics:

•   address family (INET/INET6)
•   IP/IPv6 protocol number
•   source IP/IPv6 address
•   source TCP/UDP port
•   destination IP/IPv6 address
•   destination TCP/UDP port
•   total number of bytes trasferred

Kernel must be compiled with bpf(4) (Berkeley Packet Filter) support.

The options are follows:

-a interval
    Dump traffic to file every interval minutes.

-A  portrange[:port] [,...] Aggregate ports in range portrange including boundaries as port. If port is not specified or equals to zero, aggregation of specified ports doesn't take place. The shortest interval takes precedence if ranges overlap. For example, in this statement:

        -A 1024-49151:1024,3128,6667-6669

    ports from 1024 till 49151 are counted as 1024, while port 3128 and ports in range 6667-6669 are not aggregated and treated as they are.

-d  Do not daemonize cnupm, log messages to stderr.

-D  Use daily dump files.

-e  Create an entry in traffic dump file even if no traffic collected.

-f family
    Collect packets of specified address family (inet/inet6) only.

-F file
    Use file as input for the filter expression. Any additional expressions given on the command line are ignored.

-i interface
    Listen on interface. If unspecified, cnupm searches the system interface list for the lowest numbered, configured “up” interface (excluding loopback).

-k  Fork cnupm to dump traffic to file.

-m maxentries
    Keep up to maxentries traffic entries in memory. The default value is 5000.

-N  Do not collect protocol statistics. This option also disables collection of TCP/UDP ports statistics.

-O  Do not run the packet-matching code optimizer. This is useful only if you suspect a bug in the optimizer.

-p  Do not put the interface into promiscuous mode.

-P  Do not collect TCP/UDP ports statistics.

-q  Do not log dumped records count.

-t dir
    Chroot to dir instead of cnupm user's home directory.

-u user
    Switch user context to specified user instead of default ‘cnupm’.

-V  Print program version and features and exit.

SIGNALS
The following signals recognized by cnupm:

SIGINFO, SIGUSR1
    Log number of received, dropped and lost packets.

SIGHUP
    Save collected traffic statistics to a dump file.

SIGINT, SIGQUIT, SIGTERM
    Log number of received and dropped packets, save collected statistics to a dump file and exit.

AUTHORS
The cnupm program was written by Oleg Safiullin <form@pdp-11.org.ru>

BUGS
Sure ;)

FILES
~cnupm/cnupm-netifX.pid
    process ID of running cnupm listening on netifX.
~cnupm/cnupm-netifX.dump
    traffic dump file for netifX.
~cnupm/cnupm-netifX-yyyymmdd.dump
    daily traffic dump file for netifX.

SEE ALSO
pcap(3), bpf(4), cnupmstat(8), tcpdump(8)