Softflowd

Softflowd is flow-based network traffic analyser capable of Cisco
NetFlow data export. Softflowd semi-statefully tracks traffic
flows recorded by listening on a network interface or by reading
a packet capture file. These flows may be reported via NetFlow to
a collecting host or summarised within softflowd itself. 

Details

Softflowd semi-statefully tracks traffic flows. Upon expiry of a
flow, its statistics are accumulated and (optionally) a NetFlow v.1
packet is sent to a designated collector host. Currently the statistics
collected are summaries only: min/max/avg/total bytes, packets on a
aggregate or per-protocol basis. Future version will add per-port
statistics and some per-host statistics (useful for traffic accounting). 

As softflowd watches traffic promiscuously, it is likely to place
additional load on hosts or gateways on which it is installed. However,
this implementation has been designed to minimise this load as much as
possible. Alternately, softflowd can read pcap save files recorded from
tcpdump and friends. 

Unless reading from a traffic dump, softflowd run as a daemon. A "remote
control" program (softflowctl) is included which allows runtime control
and extraction of statistics from a daemonised softflowd. 

Softflowd is developed on Linux and OpenBSD. It requires libpcap and
its associated headers to build, these are available from tcpdump.org,
or from your operating system vendor. 

The Softflowd homepage is located at:

	http://www.mindrot.org/softflowd.html

Cryptographic signatures and checksums may be provided by 
the developers at the URL(s) above.  Wiretapped recommends
that users check these before use of the software/information.