News

IPAcco 0.2.0.1 Released

8 Nov 2005

This is a bug fix and compatibility release. Now IPAcco is compatible with PHP 5.x. Also some Unix-Windows compatibility issues were solved.

What is IPAcco?

IPAcco is a free software package that helps a network admin to collect, visualize and analyze IP accounting data from the Cisco routers. Cisco routers themselves are capable of collecting IP accounting information – i.e. an unordered set of IP source-destination pairs along with a byte and packet counters corresponding to all network traffic flows that passed through the router's interfaces. These data can be a useful source for various analysis procedures and billing systems but by itself, in their raw form they are rather difficult to read and understand. In addition, a router cannot keep a lot of data – its memory is needed for purposes other than remembering what traffic, from what sources and where it forwarded two month ago.

In order to extract something useful from IP accounting data, a network admin should unload in some way this data from the router, collect it in some ordered storage and at last have a tool to retrieve from this this storage exactly what he needs. That is where IPAcco can help. It does exactly those things: downloads IP accounting data from the router using a network connection, stores it in the MySQL database and provides Web access to the collected data, presenting it in a convenient graphical form and allows user to specify various criteria for data selection.

How it works?

IPAcco keeps its data in four sets of database tables. First, it places the data downloaded from the router to the “Day” set of tables. Then, as time go, IPAcco gets data from the “Day” tables, squeezes it summarizing by bigger time periods than it was originally gathered and moves it to the “Week” tables, cutting the data from the oldest readouts. Similarly it moves data from the “Week” tables to the “Month” ones and, finally, from the “Month” to the “Year” tables.

Obviously, the idea is taken from MRTG. This mechanism lets IPAcco database not grow after the initial period of data accumulation and growth is finished. The result looks like on the picture to the right.

But IPAcco can do much more. Unlike MRTG, IPAcco remembers not only the amount of traffic passed through the router, but also source and destination addresses. Therefore you may always restore the picture of the traffic flows for any moment of the monitoring period. For example, it is usually possible to find out “who have eaten all bandwidth between 10 and 12 p.m. last Monday”, “from where someone tried to hack the web-server on Saturday night” and solve many similar problems. The example picture of the traffic flow distribution by source or destination addresses is shown on the next figure.

IPAcco has rather sophisticated data selection and filtering mechanism, so the admin performing analysis can filter out the unneeded flows an concentrate on the data and the time period he is actually interesting.

But to see once is usually better than to hear (or read) 100 times. So you can just see a demo instance of IPAcco, working with a small example database right here, on this site. Press “Demo” button on the top of this page and see it.

What IPAcco can not?

Currently IPAcco knows nothing about specific IP-protocols and ports. This lack is inherent because IP-accounting is the only information source for IPAcco and IP-accounting does not deal with protocols and ports. The next version of IPAcco will also collect data from NetFlow (hopefully) and then it will provide protocol- and port-based filtering capability.

How much does it cost?

Nothing. At least currently. IPAcco is distributed freely under BSD-style license.