Intro:
My NAS (Hiper Total Control - 1000) send physically transfered bytes in
PW_ACCT_OUTPUT_OCTETS value pair to Radius-d. Because data may be compressed
this value small then real traffic. (avg. 25-30%)

Free-RADIUS module 'rlm_flow' with 'flowmux' may use Net-Flow data.
(CISCO cached Net-Flow entry's. You may use
'ip flow-cache entries VALUE' for increase lag.
But CISCO not recommended it :))

How this work:

New Net-Flow Scheme with flowmux:

       Flow-Data             Flow-Data
CISCO -----------> flowmux ----------> flow-capture
         UDP          ^       UDP
                      |
Free-RADIUS <---------+
               TCP

CISCO send Net-Flow data to 'flowmux' wicht analyze it
(check sender address and correct contents) and then resend to
'flow-capture/flow-receive' (See http://www.splintered.net/sw/flow-tools/)
Also 'flowmux' receive three commands:
FLOW_ACCT_START - begin accounting traffic (octets) for specified IP-address.
FLOW_ACCT_STOP  - end account, send traffic count and zero it for specified
                  IP-address.
FLOW_ACCT_SEND  - send traffic count for specified IP-address.
/* Last command used my billing system for prepay-ed users. */

On PW_STATUS_ALIVE/PW_STATUS_START 'rlm_flow' send to 'flowmux'
FLOW_ACCT_START with client IP-address.
On PW_STATUS_STOP 'rlm_flow' send to 'flowmux' FLOW_ACCT_STOP with client
IP-address and receive traffic count for this IP.
Final 'rlm_flow' replace value of ACCT_OUTPUT_OCTETS attribute to received
count.

For compiling this module need use '--with-experimental-modules' option
Into radiusd.conf need include (example):
modules {
...
	flow {
		flowmuxhost = emma.vtelecom.ru
		flowmuxport = 1234
		# num_sockets = 3 (default)
		# timeout = 5 (default 5 sec)
	}
...
}

preacct {
...
	flow
}


Example usage:

flowmux -p emma/1234 -i emma/vtk-gw/9999 -e localhost/localhost/9998
flow-capture [other options] localhost/localhost/9998

WARNING!!! This module compiled and tested on FreeBSD-4.5-STABLE
For REAL replacing Acct_Output_Octets uncomment #if 0 ... #endif in rlm_flow.c

==========================================================================
For real hackers :)
1. Documentation !!!

2. Make flowmux capture Flow data from many CISCO's.
For this need *I think* make parsing configuration file like:
IMPORT {
	host ...
	port ...
}
IMPORT {
	host ...
	port ...
}
...
EXPORT {
	host...
	port ...
}

3. Better algorithm for save accounting in 'flowmux'.
Now I use allocation memory for 255 address every different 'C' net.
See flowmux.h. (struct ip_count)

4. More universal. Acct_Input..., Acct_Output... and/or add new
attribute in dictionary like Flow_IN/OUT_Octets.

5. Some other :)))

	Best Wishes! Nikolay P. Romanyuk <mag@vtelecom.ru>
P.S. Sorry for my English :)
