pmacct (Promiscuous mode IP Accounting package) now able to create and export sFlow and NetFlow datagrams !

Welcome to the pmacct project!

  Overview | Downloads | Mailing lists | Contacts

OVERVIEW.
IP accounting is key activity underlying popular ISP/IXP network operations like billing, graphing network resources usage, live or historical traffic trends analysis, management of network thresholds and SLA monitoring. Often SNMP counters do not help because of their coarse granularity; traffic mirroring, NetFlow and sFlow break this barrier by offering data at a finer granularity, ie. intercepting logical entities of greater interest such as Autonomous Systems, departmental or customer networks or just specific traffic flows. But actual high-speed large-scale networks are able to produce, in very short times, high amounts of data that become quickly difficult to be processed. In this context, traffic aggregation and advanced filtering and sampling capabilities become key requirements.

pmacct is a small set of passive network monitoring tools to measure, account, classify, aggregate and export IPv4 and IPv6 traffic; its main features are:

Runs on Linux, BSDs, Solaris and embedded systems
Support for both IPv4 and IPv6
Collects data through libpcap, NetFlow v1/v5/v7/v8/v9 and sFlow v2/v4/v5
Saves data to a number of backends including memory tables, MySQL, PostgreSQL and SQLite
Exports data to remote collectors through NetFlow v5/v9 and sFlow v5 (from 0.11.x)
Flexible architecture to tag, filter, redirect, aggregate and split captured data
Traffic streams classification. Read more here (from 0.10.x)
Support for sampling and renormalization
Pluggable architecture for easy integration of new capturing environments and data backends
Careful SQL support: data pre-processing, triggers, recovery methods, dynamic table naming

Either using memory or SQL tables as backend storage, pmacct can easily feed data into external tools including RRDtool, GNUPlot, Net-SNMP, MRTG and Cacti among the others. Little scripting abilities are required and a number of sample scripts, contributions, web frontends and some tutorials are already available.

DOWNLOADS.
Important notice! This software is under development: please download the latest version available.

pmacct.
http://www.pmacct.net/pmacct-0.11.5.tar.gz | ChangeLog | FAQS | CONFIG-KEYS | Latest
Size: 423251 bytes | Date: 21-Jul-2008

http://www.pmacct.net/pmacct-0.11.4.tar.gz
Size: 422189 bytes | Date: 25-Apr-2007

http://www.pmacct.net/pmacct-0.11.3.tar.gz
Size: 417160 bytes | Date: 31-Jan-2007

http://www.pmacct.net/pmacct-0.11.2.tar.gz
Size: 411711 bytes | Date: 28-Nov-2006

http://www.pmacct.net/pmacct-0.11.1.tar.gz
Size: 419387 bytes | Date: 25-Oct-2006

Freshest code snapshot is now available through CVS
* Set CVSROOT=:pserver:anonymous@cvs.pmacct.net:/home/repo
* cvs login (password is 'pmacct')
* cvs co pmacct
Last CVS commit on: 28-Sep-2008

pmacct-contribs.
http://www.pmacct.net/pmacct-contribs-20051103.tar.gz | README | ChangeLog | Latest
Size: 31182 bytes | Date: 03-Nov-2005

DOCUMENTS.
Presentation: IP accounting reloaded: the pmacct project (EN), Paolo Lucente, Jan 2007 @ UKNOF6, May 2007 @ INEX Members meeting (pdf)
Presentation: pmacct, a new player in the network management arena (EN), Paolo Lucente, Apr 2006 @ Plenary session, RIPE 52 Meeting (pdf)
Presentation: Utilizzo di strumenti di network accounting a supporto della gestione di infrastrutture complesse (IT), Massimo Ianigro, Paolo Lucente, May 2005 @ GARR Conference 2005 (pdf)
Paper: pmacct: steps forward interface counters, Paolo Lucente, Mar 2005 (pdf)
Guide: Make graphs: pmacct 0.8.x and Cacti, Pedro Sanchez, Feb 2005 (html)

LINKS.
Some scripts/tools related to or topped over pmacct. In alphabetical order.

BWstat: a network traffic statistical tool written in PHP.
FloX (Flow eXplorer): a simple PHP tool to examine large tables of flow data in a SQL database.
NetAct: an active network management tool, for graphing individual host activities and make individual host behavior patterns. NEW!
pmacct-fe: a frontend tool to present network statistics.
pmacct-snmp: a package to export network data through SNMP.
pNRG: the pmacct's Network Resource Grapher.

PACKAGES.
A few pointers to packaged versions of pmacct. Mantainers are listed in the AUTHORS doc: feedbacks need to be addressed directly to them. Do you know of any packaged version not listed here ? Please, let me know.

OpenSUSE/Fedora RPMs packaged by Peter Nixon are available here
Fedora RPMs packaged by Douglas E. Warner are available here

REQUIREMENTS.
libpcap >= 0.6.x -- http://www.tcpdump.org/

PLATFORMS.
It has been tested and reported to work on:
Red Hat Linux 7.x/8.x/9.x
Fedora Core 1/2/3/4/5
Slackware Linux 8.x/9.x
Gentoo Linux 1.4.x/1.6.x
SuSE Linux 9.x/10.x
Debian 3.x
Solaris 8/9/10 x86/sparc
FreeBSD 4.x/5.x/6.x x86/sparc
OpenBSD 3.7/3.8/3.9 x86/sparc
NetBSD 2.0 x86
LEAF Bering-uClibc

Did you successfully completed compilation and installation of the software on other operating system or architecture not listed here ? Please, let me know.

NETFLOW.
Supported versions: V1/V5/V7/V8/V9

Netflow datagrams have been read successfully from:
Cisco routers: 2xxx, 3xxx, 7xxx, 12xxx; IOS >= 11.2
Juniper M series; JunOS 6.x

Did you successfully read Netflow datagrams from other network gears ? Please, let me know.

SFLOW.
Supported versions: V2/V4/V5

sFlow datagrams have been read successfully from:
HP Procurve 2800, 3400, 4200 and 9300 series
Foundry Networks Bigiron 8000 series
Foundry Networks FastIron Edge, Edge X and Workgroup Edge series
Foundry Networks NetIron XMR series
Force10 E series (E300, E600, E1200)
Extreme Black Diamond 8800 series

Did you successfully read sFlow datagrams from other network gears ? Please, let me know.

PROMISCUOUS MODE.
Other than traditional Ethernet NICs, datagrams have been read successfully from:
Endace DAG Ethernet cards; libdag 3.0

MAILING LISTS.
If you are interested in news (new releases and Changelogs, etc.) either about the project itself or related ones, subscribe to the pmacct-news mailing list. The list can be open for posting - on request, see CONTACTS - to developers involved in projects based on pmacct.

Description: News from the project: new releases, general annoucements, what is about to happen, etc.

Subcribe instructions: send a blank email to:
Traffic flow: very low

However, if you don't like to get in touch with our smiley mailing-list robot, you can still track new pmacct releases subscribing to the project on Freshmeat.Net. For further informations, take a look to the Freshmeat page

Description: Discussion about project development. A place where talk about what the project still misses, new ideas, novel approaches, etc. It's also the place where to get in touch with other pmacct users.

Subcribe instructions: send a blank email to:
Traffic flow: moderate
Archive: http://www.mail-archive.com/pmacct-discussion@pmacct.net/

Description: CVS commits from pmacct developers.

Subcribe instructions: send a blank email to:
Traffic flow: low

Archive: http://www.mail-archive.com/pmacct-commits@pmacct.net/

LICENSE.
Licensed under The GNU General Public License, Version 2. see COPYING for details.

CONTACTS.
Any comment is warmly welcome. Feel free to contact me for bugs, critics, requests, suggestions or even for a simple feedback with your opinions about the work done at: