This project is a daemon that will analyze (but not record to disk) network traffic using a user-supplied set of BPF expressions, making the counts of packet matches and bytes available via net-snmp so that they can be queried or graphed (eg, by cacti).
Created by Dennis Jenkins while at iStream Financial Services, Inc. Released as open-source with permission of my employer.
-
Instlal these Gentoo packages (or more recent versions): net-libs/libnids-1.18 dev-libs/confuse-2.6-r3 net-libs/libpcap-1.0.0-r2 net-libs/libpcapnav-0.7
-
"sudo emerge -avu libnids confuse libpcap libpcapnav"
-
Compile source code: "make"
-
Install binary: "sudo make install"
-
Modify "/etc/snmp/snmpd.conf", add "master agentx" near bottom.
-
Restart "snmpd"
-
Edit "/etc/pcap-snmp-monitor" (create some sample filters).
-
Test program "sudo /usr/local/sbin/pcap-snmp-monitor -v"
-
snmpwalk -On -c public -v 2c 127.0.0.1 .1.3.6.1.4.1.8072
-
Kill test process.
-
Add to gentoo startup: "sudo rc-update add pcap-snmp-monitor default"
-
Start as managed service (and retest) "sudo /etc/init.d/pcap-snmp-monitor start"