Beta
----

	This is a beta release. I have done very little testing on different
	platforms. There are a number of things in the source that still need
	to be ifdefed based on autoconf checks. The man page is also not yet
	finished.

About bpfcount
--------------

	bpfcount generates network use statistics for various categories of
	network traffic defined by BPF filter expressions (which are commonly
	used for filtering by sniffers such as tcpdump(1)). bpfcount takes as
	input a saved network packet capture file (such would be generated by
	'tcpdump -w outfile' and a series of BPF filter expressions. bpfcount
	will output a series of lines containing the average number of bytes per
	second received by each filter expression.

	The 'bpfgraph' part above is a perl program included in the bpfcount
	package. As an alternative to capturing network traffic with tcpdump,
	see my program netdumpd for a daemon which can help with this task and
	supports automated file rotation.


Using the bpfgraph utility
--------------------------

	A perl program called 'bpfgraph' is included in the source distribution
	in the tools directory. This program can be used to generate graphs
	from bpfcount's output.

	To use bpfgraph, you need the GD::Graph perl module. On debian do
	'apt-get install libgd-graph-perl'.

	Command line help is available with the -h option demonstrating options
	and usage.


Notes
-----

	On Redhat 7.x configure or compilation may fail with errors about
	net/bpf.h not existing, or configure may tell you that it cannot
	find pcap.h when you in fact have it. I think this is a bug with
	Redhat's libpcap packages. See below for instructions on how to fix
	it, or install libpcap >= 0.7.2 from source.


Fixing Redhat pcap build/configure problems
-------------------------------------------

	As mentioned above in the Notes section, this may be needed if
	you're on Redhat 7.x and configure tells you you don't have pcap.h
	when in fact you do.

	Edit your pcap.h file (/usr/include/pcap/pcap.h on RH 7.x).

	Line 42 reads:

		#include <net/bpf.h>
	
	Change it to read:

		#include <pcap/net/bpf.h>

	Now try rebuilding.
	

Reporting Bugs / Comments / Requests / Patches
----------------------------------------------

        Send me (Steve Benson) an email at
        steve@rhythm.REMOVE_THIS_SPAMTRAP.cx if you have questions or find
        bugs or anything.