pmacct 0.14.3 / 1.5.0 RC1

An Open Source collection of small IPv4/IPv6 accounting and aggregation tools for Linux
pmacct is an open source command-line software that contains a small collection of passive network monitoring utility, which allow users to export, measure, classify, account and aggregate IPv6 and IPv4 traffic.

Among the highlights of pmacct, we can mention support for Cisco NSEL and Cisco NEL for CGNAT, MPLS/BGP VPNs rfc4364 support, inspection of tunnelled traffic, GeoIP lookups, support for SQL, traffic streams classification, and much more.

pmacct is also capable of exporting data into external utilities, such as GNUPlot, RRDtool, Net-SNMP, Cacti and MRTG. It only works in UNIX operating systems.

last updated on:
December 18th, 2013, 7:36 GMT
license type:
GPL (GNU General Public License) 
developed by:
Paolo Lucente
ROOT \ Internet \ Log Analyzers
Download Button

In a hurry? Add it to your Download Basket!

user rating 11



Rate it!
What's New in version 1.5.0 RC1
  • Introducing custom-defined aggregation primitives: primitives are defined via a file pointed by aggregate_primitives config directive. The feature applies to NetFlow v9/IPFIX fields only, and with a pre-defined length. Semantics supported are: 'u_int' (unsigned integer, presented as decimal number), 'hex' (unsigned integer, presented as hexa- decimal number), 'ip' (IP address), 'mac' (MAC address)and 'str' (string). Syntax along with examples are available in the 'examples/primitives.lst' file.
  • Introducing JSON output in addition to tabular and CSV formats. Suitable for injection in 3rd party tools, JSON has the advantage of being a self- consisting format (ie. compared to CSV does not require a table title). Library leveraged is Jansson, available at:
  • Introducing RabbitMQ/AMQP pmacct plugin to publish network traffic data to message exchanges. Unicast, broadcast, load-balancing scenarios being supported. amqp_routing_key supports dynamic elements, like the value of peer_src_ip and tag primitives or configured post_tag value, enabling selective delivery of data to consumers. Messages are encoded in JSON format.
  • pre_tag_map (and other maps): 'ip' key, which is compared against the IP address originating NetFlow/IPFIX or the AgentId field in sFlow, can now be an IP prefix, ie. XXX.XXX.XXX.XXX/NN, so to apply tag statements to set of exporters or to apply to any exporter. Many thanks to Stefano Birmani for his support.
read full changelog

Add your review!