pmacct is an open source and freely distributed software project that contains a small collection of command-line passive network monitoring utilities, which allow users to export, measure, classify, account and aggregate IPv6 and IPv4 traffic. It comprises of the nfacctd, pmacct, pmacctd, sfacctd and uacctd tools.
Features at a glance
Key features include support for Cisco NSEL and Cisco NEL for CGNAT, inspection of tunnelled traffic, MPLS/BGP VPNs rfc4364 support, GeoIP lookups, support for SQL (triggers, data pre-processing, dynamic table naming), support for collecting data through the libpcap library, as well as through Netlink/ULOG, sFlow v2/v4/v5, NetFlow v1/v5/v7/v8/v9, and IPFIX.
Additionally, the software is also capable of exporting data to external utilities, such as GNUPlot, RRDtool, Net-SNMP, Cacti and MRTG, it is suitable for IP carrier, ISP, CDN, IXP, hot-spots and data-center environments, can save data to various backends, including MySQL, PostgreSQL, SQLite, MongoDB, BerkeleyDB, RabbitMQ, memory tables, and flat files.
Among other interesting features, we can mention support for BGP ADD-PATHS, logging of live BGP messages, dumping of BGP tables, visualization of internal routes through an IS-IS/IGP daemon, classification traffic streams, visualization of inter-domain routing plane through a BGP daemon, replication of incoming NetFlow, sFlow and IPFIX packets, and a pluggable architecture.
Getting started with pmacct
Being a command-line software, the pmacct project can only be used from a console/CLI environment. To install it on your GNU/Linux distribution, you can either use the built-in Software Center app of your operating system (e.g. Ubuntu Software Center on Ubuntu) or the source package, which is distributed for free on Softpedia and the project’s official website (see the homepage link at the end of the article).
If you decide to install pmacct using the source package, download it, save it on your Home folder, use an archive manager tool to unpack it, open a terminal emulator app and go to the location where you’ve extracted the archive file (e.g. cd /home/softpedia/pmacct-1.5.0). Then, run the ‘./configure && make’ command to configure and compile the program, followed by the ‘sudo make install’ command to install the tools system wide.
After installation, add the “--help” option to each of the included tools (see the first paragraph for details) to view their command-line options, the usage message, as well as various real life examples, which will help you to better understand how they work and how you can use them in your work. Please note that pmacct runs on Linux, BSD, Solaris, and embedded systems.