The pmacct project: libpcap, NetFlow, sFlow, memory tables, SQL, RRD, BGP, probes, stream classification and much more

Welcome to the pmacct project!

  Overview | Downloads | Mailing lists | Contacts

OVERVIEW.
IP accounting is key activity underlying essential network management tasks like billing, graphing network resources usage, live or historical traffic trends analysis, steering BGP peerings, real-time alerting and certain SLA monitoring. Often SNMP counters do not help in these areas because of their coarse granularity; live traffic mirroring, NetFlow and sFlow break this barrier by offering data at a finer granularity. But current high-speed large-scale networks are able to produce, in very short times, high amounts of data that become quickly difficult to be processed. In this context, both spatial and temporal aggregation, flexible filtering and sampling capabilities become key requirements.

pmacct is a small set of passive network monitoring tools to measure, account, classify, aggregate and export IPv4 and IPv6 traffic; its main features are:

Suitable to ISP, IXP, CDN, IP carrier, data-centre and hot-spots enviroments
Runs on Linux, BSDs, Solaris and embedded systems
Support for both IPv4 and IPv6
Collects data through libpcap, Netlink/ULOG, NetFlow v1/v5/v7/v8/v9 and sFlow v2/v4/v5
Saves data to a number of backends including memory tables, MySQL, PostgreSQL and SQLite
Exports data to remote collectors through NetFlow v5/v9 and sFlow v5
Flexible architecture to tag, filter, redirect, aggregate and split captured data
Embeds a BGP daemon to augment visibility into the network (from 0.12). Read more here
Traffic streams classification. Read more here
Support for packet and flow sampling and renormalization
Pluggable architecture for easy integration of new capturing environments and data backends
Careful SQL support: data pre-processing, triggers, dynamic table naming
It's free, open-source, developed and supported with passion and open mind

Either using memory or SQL tables as backend storage, pmacct can easily feed data into external tools including RRDtool, GNUPlot, Net-SNMP, MRTG and Cacti among the others. Little scripting abilities are required and a number of sample scripts, contributions, web frontends and some tutorials are already available.

DOWNLOADS.
Important notice! This software is under development: please download the latest version available.

pmacct.
http://www.pmacct.net/pmacct-0.12.0.tar.gz | ChangeLog | FAQS | CONFIG-KEYS | Latest
Size: 523032 bytes | Date: 16-Feb-2010

http://www.pmacct.net/pmacct-0.12.0rc4.tar.gz
Size: 519485 bytes | Date: 21-Dec-2009

http://www.pmacct.net/pmacct-0.12.0rc3.tar.gz
Size: 506242 bytes | Date: 28-Oct-2009

http://www.pmacct.net/pmacct-0.12.0rc2.tar.gz
Size: 494638 bytes | Date: 09-Sep-2009

http://www.pmacct.net/pmacct-0.11.6.tar.gz
Size: 425807 bytes | Date: 07-Apr-2009

Freshest code snapshot is now available through CVS
* Set CVSROOT=:pserver:anonymous@cvs.pmacct.net:/home/repo-0.12
* cvs login (password is 'pmacct')
* cvs co pmacct
Last CVS commit on: 12-Mar-2010

pmacct-contribs.
http://www.pmacct.net/pmacct-contribs-20091125.tar.gz | README | ChangeLog | Latest
Size: 38578 bytes | Date: 25-Nov-2009

ONLINE DOCUMENTATION.
For official and user-contributed documentation, check out our newly introduced Open Documentation effort at wiki.pmacct.net

RELEVANT DOCUMENTS AND PRESENTATIONS.
Presentation: pmacct: introducing BGP natively into a NetFlow/sFlow collector, Paolo Lucente, Sep 2009 @ UKNOF14, SwiNOG19 (pdf)
Presentation: IP accounting reloaded: the pmacct project, Paolo Lucente, Jan 2007 @ UKNOF6, May 2007 @ INEX Members meeting (pdf)
Presentation: pmacct, a new player in the network management arena), Paolo Lucente, Apr 2006 @ Plenary session, RIPE 52 Meeting (pdf)
Presentation: Utilizzo di strumenti di network accounting a supporto della gestione di infrastrutture complesse (IT), Paolo Lucente, Massimo Ianigro, May 2005 @ GARR Conference 2005 (pdf)
Paper: pmacct: steps forward interface counters, Paolo Lucente, Mar 2005 (pdf)
Guide: Make graphs: pmacct 0.8.x and Cacti, Pedro Sanchez, Feb 2005 (html)

LINKS.
Some tools related to or topped over pmacct. In alphabetical order.

BWstat: a network traffic statistical tool written in PHP.
Captrap: a set of Perl scripts designed to work with the pmacct and a MySQL database to generate tables and graphs. NEW!
FloX (Flow eXplorer): a simple PHP tool to examine large tables of flow data in a SQL database.
NetAct: an active network management tool, for graphing individual host activities and make individual host behavior patterns.
pmacct-fe: a frontend tool to present network statistics.
pmacct-snmp: a package to export network data through SNMP.
pmGraph: an application for network monitoring to help network administrators to better monitor and manage their networks. NEW!
pNRG: the pmacct's Network Resource Grapher.
Pycontrole: a tool to manage customers of an ISP in Python

PACKAGES.
A few pointers to packaged versions of pmacct. Mantainers are listed in the AUTHORS doc: feedbacks need to be addressed directly to them. Do you know of any packaged version not listed here ? Please, let me know.

OpenSUSE RPMs packaged by Peter Nixon are available here
Fedora RPMs packaged by Douglas E. Warner are available here
ALTLinux RPMs packaged by Slava Dubrovskiy are available here

REQUIREMENTS.
libpcap >= 0.6.x -- http://www.tcpdump.org/

PLATFORMS.
It has been tested and reported to work on:
All major Linux distributions
Solaris 8/9/10 x86/sparc
FreeBSD 4.x/5.x/6.x x86/sparc
OpenBSD 3.7/3.8/3.9 x86/sparc
NetBSD 2.0 x86
LEAF Bering-uClibc

Did you successfully completed compilation and installation of the software on other operating system or architecture not listed here ? Please, let me know.

NETFLOW.
Supported versions: V1/V5/V7/V8/V9

Netflow datagrams have been read successfully from:
Cisco routers: 2xxx, 3xxx, 7xxx, 12xxx; IOS >= 11.2
Juniper M/MX/T series; JunOS >= 6.x

Did you successfully read Netflow datagrams from other network gears ? Please, let me know.

SFLOW.
Supported versions: V2/V4/V5

sFlow datagrams have been read successfully from:
HP Procurve 2800, 3400, 4200 and 9300 series
Foundry Networks Bigiron 8000 series
Foundry Networks FastIron Edge, Edge X and Workgroup Edge series
Foundry Networks NetIron XMR series
Force10 E series (E300, E600, E1200)
Extreme Black Diamond 8800 series
Juniper EX 4200 series

Did you successfully read sFlow datagrams from other network gears ? Please, let me know.

PROMISCUOUS MODE.
Other than traditional Ethernet NICs, datagrams have been read successfully from:
Endace DAG Ethernet cards; libdag 3.0

MAILING LISTS.
If you are interested in news (new releases and Changelogs, etc.) either about the project itself or related ones, subscribe to the pmacct-news mailing list. The list can be open for posting - on request, see CONTACTS - to developers involved in projects based on pmacct.

Description: News from the project: new releases, general annoucements, what is about to happen, etc.

Subcribe instructions: send a blank email to:
Traffic flow: very low

However, if you don't like to get in touch with our smiley mailing-list robot, you can still track new pmacct releases subscribing to the project on Freshmeat.Net. For further informations, take a look to the Freshmeat page

Description: Discussion about project development. A place where talk about what the project still misses, new ideas, novel approaches, etc. It's also the place where to get in touch with other pmacct users.

Subcribe instructions: send a blank email to:
Traffic flow: moderate
Archive: http://www.mail-archive.com/pmacct-discussion@pmacct.net/

Description: CVS commits from pmacct developers.

Subcribe instructions: send a blank email to:
Traffic flow: low

Archive: http://www.mail-archive.com/pmacct-commits@pmacct.net/

LICENSE.
Licensed under The GNU General Public License, Version 2. see COPYING for details.

CONTACTS.
Any comment is warmly welcome. Feel free to contact me for bugs, critics, requests, suggestions or even for a simple feedback with your opinions about the work done at: