pmacct 1.7.9 NetFlow, sFlow and IPFIX Network Traffic Accounting Collector on Ubuntu 24.04 LTS

Overview

pmacct is a mature, widely deployed suite of network traffic accounting tools. Its collector daemon receives flow exports, NetFlow v5 and v9, IPFIX and sFlow, from the routers, switches and firewalls on your network, and it can also account traffic directly from a captured interface. Every flow is aggregated in memory by the primitives you choose, such as source and destination host, source and destination port, IP protocol and source and destination autonomous system, and the running totals of packets and bytes are periodically written out to a backend. That turns a firehose of raw flow records into compact, queryable accounting: who talked to whom, over which ports and protocols, and how much traffic each conversation carried. It is the engine many organisations use for capacity planning, traffic engineering, peering analysis, billing and security investigation, without sending any of the data to a third party.

Common uses

• Collect NetFlow, sFlow and IPFIX from routers and switches in one place
• Aggregate traffic by source, destination, port, protocol and AS number
• Feed per host and per conversation accounting into a SQL database for analysis