[counters]
Send
Recv

The value for this option should either be mac or ip. The option indicates if the daemon should run in MAC or IP based addressing mode. That is, if the table maintained by the daemon should be indexed by MAC or IP address.

Tells the wipld daemon to drop superuser privileges and become the specified user as soon as the interface is opened. value can be both a username or a numerical uid.

Tells the wipld daemon to drop superuser privileges and become part of the specified group as soon as the interface is opened. value can be both a group name or a numerical gid.

This sets the name of the logfile. The file is reopened when the daemon receives a HUP signal. If the file does not exists it is created with the permission of the daemon as specified by the user and group options.

If this is set to a non-zero value an entry is written to the logfile every time an IP/MAC address is changed for an entry in the table.

If this is set to a non-zero value it is logged when an invalid IP packet is seen.

If this is set to a non-zero value it is logged when the least recently lookuped entry is deleted from the table maintained by the daemon as described in the maxentries option.

If this is set to 0 the network interface is not put into promiscuous mode.

The maximal number of entries in the table maintained by the daemon. If more entries are tried created the least recently lookuped entry will be erased. This number is needed because the shared memory area maintained by the daemon has a fixed size.

The network device to get packages from. If this option is not present the daemon will try to find an appropriate device.

This is an expression that will determine which packets the daemon will see. The expression should have a format as given to the popular tcpdump(8) program. The filter has two purposes: First, you can use it to prevent the program in the [program] section from seeing some packages. Second, you might get a significant performance increase if you filter away the packets you are ignoring.

To this the process id of the daemon will be written.

If this value is non-zero then proxy remapping support is enabled. Proxy remapping support makes it possible for a proxy server to inform wipld by on behalf of which machines it transfers packages. And wipld will then account packages transferred by the proxy server to the machine actually requesting the information.
The value should be set to the maximal number of concurrent connections the proxy server can make. A typical value is 2048.

This file is used as the communication point between the daemon and it's clients. It is possible to have multiple daemons running at the same time if they use different daemon files. The specified file must exists.

[program]
srcmac[0]+=size;
dstmac[1]+=size;

[program]
if(dstmac==11:22:33:44:55:66 && dstip!=1.2.3.4) 
  srcmac[0]+=size;
else if(srcmac==11:22:33:44:55:66 && srcip!=1.2.3.4) 
  dstmac[1]+=size;

[program]
bool s = (srcip/24 == 192.168.1.0);
bool d = (dstip/24 == 192.168.1.0);
if (s && !d) {
  srcip[0]+=size;
  (srcip/24)[0]+=size;
} else if (d && !s) {
  dstip[1]+=size;
  (dstip/24)[1]+=size;
}

int a;

Usually the daemon is started and stopped by this script.

Default configuration- and daemonfile.

Default logfile

Default pidfile