IPAUDIT (Jan 12, 2000)
=======

IPAUDIT listens to a network device in promiscuis mode, and records
of every 'connection', each conversation between two ip addresses.  A unique
connection is determined by the ip addresses of the two machines, the 
protocol used between them and the port numbers (if they are communicating
via udp or tcp).

It uses a hash table to keep track of the number of bytes and packets
in both directions.  When IPAUDIT receives a signal SIGTERM (kill)
or SIGINT (kill -2, usually the same as a Control-C), it stops collecting
data and write the tabulated results.


Suggested Usage
---------------
IPAUDIT can be used to monitor network activity for a variety of purposes.
It has proved useful for monitoring intrusion detection, bandwidth consumption 
and denial of service attacks.

We run it in shifts.  Every 30 minutes launch an new instance of IPAUDIT
in the background and kill the previous instance.  Before the previous
instance dies it writes a file describing the network activity for the
past 30 minutes.  Perl scripts then parse this file and make a Web
viewable report.  It currently monitors a 45MB link averaging at about
1/3 capacity on a Pentium II/333 running Linux 2.2.13.  Average CPU
usage is at about 10%, and peaks at around %20 on the half hour.


Installing
----------
(1) You must first have pcap library installed (see Requirements below).
(2) Type 'make' to produce ipaudit executable.  Ipaudit must be run as root.  
(3) Copy man page ipaudit.1 to your man page directory.
(4) optionally copy man page ipstrings.1, total.1 to man page directory.


Documentation
-------------
See the man pages ipaudit.1, ipstrings.1, total.1 and web page 
   http://sp.uconn.edu/~jrifkin/ipaudit/


Contact Info
------------
Jon Rifkin <j.rifkin@uconn.edu>.  The most recent version of
IPAUDIT is at

   http://sp.uconn.edu/~jrifkin/ipaudit/

If you are having trouble with ipaudit, please send output 
when running with the -d option.


Requirements
------------
IPAUDIT uses the pcap library which is available from the
URL http://www-nrg.ee.lbl.gov/nrg.html.


License
-------

IPAUDIT is covered by the GNU General Public Licensse. 
See the file COPYING for copying permission.

IPAUDIT is Copyright (c) 1999,2000 by Jonathan Rifkin
