pmacct
pmacct is a free, self-hosted suite of passive network monitoring tools for Linux.
What pmacct is
pmacct is a free, self-hosted suite of passive network monitoring tools for Linux. It collects NetFlow, IPFIX, and sFlow traffic, while separate daemons handle BGP, BMP, and Streaming Telemetry. The tools can replicate and export network information, then filter, sample, tag, classify, renormalize, and aggregate traffic, including at layer 7. Data can be kept in memory, relational or NoSQL databases, or flat files, and can also be sent to AMQP or Kafka brokers. Documented options include MySQL/MariaDB, PostgreSQL, SQLite, MongoDB, Elasticsearch, InfluxDB, Druid, and ClickHouse. Output formats include text, CSV, JSON, and Apache Avro, and a command-line client can query memory-table data. Official Docker images cover seven daemons; images are built for linux/amd64 and linux/arm64, with arm64 support marked experimental. SQL, AMQP, and Kafka plugins are disabled by default and need compile-time support enabled. The project advises planning for CPU, memory, and disk needs when retaining every flow.
Good
- Free plan with self-hosted Linux deployment.
- Processes NetFlow, IPFIX, and sFlow traffic.
- Supports filtering, sampling, tagging, and aggregation.
- Offers text, CSV, JSON, and Avro output.
- Official images cover seven daemons.
Watch out
- arm64 container support is experimental.
- SQL, AMQP, and Kafka plugins are disabled by default.
- Storing every flow can increase CPU, memory, and disk use.
- Memory plugin is intended for smaller or prototype environments.
Who it suits
pmacct suits Linux operators who need to collect and process network traffic data with configurable filtering, classification, and aggregation. Its documented deployment options include self-hosting with Docker, Docker Compose, or Kubernetes.
Verdict
pmacct offers broad traffic collection and processing options for teams prepared to configure and operate a self-hosted toolset. Check plugin build requirements and storage capacity needs before choosing it.
The facts
Each one read from pmacct's own pages, with the date it was checked.
What it does
- Build requirements
- The quickstart says libpcap and its headers are the package’s only dependency, while SQL, AMQP and Kafka plugins are disabled by default.checked 3 Oct 2026
- Collection and processing
- It can collect, replicate and export network information, and aggregate, filter, sample, renormalize, tag and classify traffic at layer 7.checked 3 Oct 2026
- Command line client
- The pmacct client can query memory-table data and format output as text, CSV, or JSON.checked 4 Oct 2026
- Configuration limit
- SQL, AMQP, and Kafka plugins are disabled by default and require their support to be enabled at compile time.checked 4 Oct 2026
- Data destinations
- The project documents output to MySQL, PostgreSQL, SQLite, flat files, AMQP, and Kafka.checked 4 Oct 2026
- Deployment
- The project provides official Docker images and build instructions for Debian or Ubuntu and CentOS or RHEL.checked 4 Oct 2026
- Documentation
- The repository links to a wiki and includes a quickstart, FAQ, configuration key reference, examples and SQL documentation.checked 3 Oct 2026
- Integrations
- The documentation names MySQL/MariaDB, PostgreSQL, SQLite, BerkeleyDB, MongoDB, RabbitMQ, Kafka, Elasticsearch, InfluxDB, Druid and ClickHouse among supported storage or consumer options.checked 3 Oct 2026
- Message consumers
- The documentation names Elasticsearch, InfluxDB, Druid, and ClickHouse as examples of systems that can consume data through messaging brokers.checked 4 Oct 2026
- Output formats
- The print plugin supports tab-spaced, CSV, and JSON output, and the documentation also describes Apache Avro output.checked 4 Oct 2026
- Product
- pmacct is a set of passive network monitoring tools for NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP and Streaming Telemetry.checked 3 Oct 2026
- Protocols
- Its tools cover NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP, and Streaming Telemetry.checked 4 Oct 2026
- Purpose
- pmacct is a set of passive network monitoring tools for accounting, classifying, aggregating, and exporting network traffic.checked 4 Oct 2026
- Resource considerations
- The FAQ cautions that storing every flow can increase CPU, memory and disk use and recommends planning resources for that level of detail.checked 3 Oct 2026
- Scale guidance
- The documentation says the memory plugin is intended for prototyping, lab use without mass traffic generation, and smaller or home production environments.checked 4 Oct 2026
- Scaling
- The FAQ says deployments can scale through aggregation, filtering, sampling and tagging, or by distributing input across multiple pmacct instances.checked 3 Oct 2026
- Security information
- The opened project pages describe collection and output capabilities but do not state security certifications or compliance attestations.checked 4 Oct 2026
- Storage and output
- Traffic data can be stored in memory, relational or NoSQL databases, and flat files, or published to AMQP and Kafka brokers.checked 3 Oct 2026
- Support and documentation
- The project points users to online GitHub wiki pages and documentation included in the distribution, including a quickstart and FAQ.checked 4 Oct 2026
- Support and troubleshooting
- The Docker documentation provides troubleshooting guidance and says bug reporters may be asked to provide debugging information.checked 3 Oct 2026
- Traffic processing
- Traffic data can be filtered, sampled, tagged, classified, and aggregated using configurable primitives.checked 4 Oct 2026
Where it runs
- Container platforms
- Official Docker images are built for linux/amd64 and linux/arm64, with arm64 support marked experimental.checked 3 Oct 2026
Alternatives to pmacct
- 1
ntopng
Free planOpen sourceWebAPILinuxmacOS8.3€299.95 one-time - 2
ManageEngine NetFlow Analyzer
Free planAndroidiOSWebLinux7.1From $172 a month - 3
ElastiFlow
Free planWebAPILinuxSelf-hosted6.9Free plan - 4
FlowViewer
Free planWebLinux6.8$500 one-time - 5
SparrowIQ
AndroidiOSWebWindows6.6 - 6
Plixer Scrutinizer
WebAPISelf-hosted6.5From $12,996 a year