pmacct

Spec sheet

Purpose

pmacct is a set of passive network monitoring tools for accounting, classifying, aggregating, and exporting network traffic.Read 4 Oct 2026 · github.com

Product

pmacct is a set of passive network monitoring tools for NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP and Streaming Telemetry.Read 3 Oct 2026 · github.com

Deployment

The project provides official Docker images and build instructions for Debian or Ubuntu and CentOS or RHEL.Read 4 Oct 2026 · github.com

Integrations

The documentation names MySQL/MariaDB, PostgreSQL, SQLite, BerkeleyDB, MongoDB, RabbitMQ, Kafka, Elasticsearch, InfluxDB, Druid and ClickHouse among supported storage or consumer options.Read 3 Oct 2026 · github.com

Build requirements

The quickstart says libpcap and its headers are the package’s only dependency, while SQL, AMQP and Kafka plugins are disabled by default.Read 3 Oct 2026 · github.com

Collection and processing

It can collect, replicate and export network information, and aggregate, filter, sample, renormalize, tag and classify traffic at layer 7.Read 3 Oct 2026 · github.com

Command line client

The pmacct client can query memory-table data and format output as text, CSV, or JSON.Read 4 Oct 2026 · github.com

Configuration limit

SQL, AMQP, and Kafka plugins are disabled by default and require their support to be enabled at compile time.Read 4 Oct 2026 · github.com

Container platforms

Official Docker images are built for linux/amd64 and linux/arm64, with arm64 support marked experimental.Read 3 Oct 2026 · github.com

Data destinations

The project documents output to MySQL, PostgreSQL, SQLite, flat files, AMQP, and Kafka.Read 4 Oct 2026 · github.com

Documentation

The repository links to a wiki and includes a quickstart, FAQ, configuration key reference, examples and SQL documentation.Read 3 Oct 2026 · github.com

Message consumers

The documentation names Elasticsearch, InfluxDB, Druid, and ClickHouse as examples of systems that can consume data through messaging brokers.Read 4 Oct 2026 · github.com

Output formats

The print plugin supports tab-spaced, CSV, and JSON output, and the documentation also describes Apache Avro output.Read 4 Oct 2026 · github.com

Protocols

Its tools cover NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP, and Streaming Telemetry.Read 4 Oct 2026 · github.com

Resource considerations

The FAQ cautions that storing every flow can increase CPU, memory and disk use and recommends planning resources for that level of detail.Read 3 Oct 2026 · github.com

Scale guidance

The documentation says the memory plugin is intended for prototyping, lab use without mass traffic generation, and smaller or home production environments.Read 4 Oct 2026 · github.com

Scaling

The FAQ says deployments can scale through aggregation, filtering, sampling and tagging, or by distributing input across multiple pmacct instances.Read 3 Oct 2026 · github.com

Security information

The opened project pages describe collection and output capabilities but do not state security certifications or compliance attestations.Read 4 Oct 2026 · github.com

Storage and output

Traffic data can be stored in memory, relational or NoSQL databases, and flat files, or published to AMQP and Kafka brokers.Read 3 Oct 2026 · github.com

Support and documentation

The project points users to online GitHub wiki pages and documentation included in the distribution, including a quickstart and FAQ.Read 4 Oct 2026 · github.com

Support and troubleshooting

The Docker documentation provides troubleshooting guidance and says bug reporters may be asked to provide debugging information.Read 3 Oct 2026 · github.com

Traffic processing

Traffic data can be filtered, sampled, tagged, classified, and aggregated using configurable primitives.Read 4 Oct 2026 · github.com

Where Specifiction places it

• Network Traffic Analysis Software#20 of 266.9
• Bandwidth Monitoring Software#29 of 337.0