pmacct
A lightweight suite of passive network monitoring tools supporting NetFlow, sFlow, IPFIX, libpcap, and BGP telemetry.
What is pmacct?
pmacct is a suite of passive network monitoring tools that collects and processes telemetry data from protocols like NetFlow, sFlow, IPFIX, and BGP. It helps network administrators and researchers analyze traffic patterns, detect anomalies, and monitor routing behavior without disrupting network operations.
Network engineers, DevOps teams, and researchers who need scalable, protocol-agnostic tools for monitoring and analyzing network traffic and routing data.
Developers choose pmacct for its lightweight design, broad protocol support, and flexibility in exporting data to various backends, making it ideal for building custom network visibility solutions.
Overview
pmacct is a small set of multi-purpose passive network monitoring tools [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry].
Use Cases
Best For
- Collecting and aggregating NetFlow/sFlow data from network devices
- Monitoring BGP routing changes and telemetry in real-time
- Analyzing network traffic patterns using libpcap captures
- Exporting network telemetry to SQL databases or message queues like Kafka
- Deploying lightweight network monitoring agents in Docker containers
- Building custom dashboards for network performance and security analytics
Not Ideal For
- Teams needing out-of-the-box network monitoring with integrated dashboards and alerts
- Projects requiring quick deployment without compilation or complex dependency management
- Environments focused on active network testing or intrusion detection systems
- Small-scale networks where lightweight SNMP-based tools suffice without telemetry processing
Pros & Cons
Pros
Ingests data from NetFlow, IPFIX, sFlow, BGP, and more, enabling comprehensive network telemetry collection from diverse sources as listed in the features.
Forwards processed data to SQL databases, AMQP, Kafka, and other systems, allowing seamless integration with custom analysis pipelines per the README.
Official Docker images are available, simplifying deployment in modern environments like Docker, as highlighted in the DOCKER IMAGES section.
Handles high-volume telemetry streams with low overhead, making it suitable for real-time monitoring without intrusive probing.
Cons
Requires manual compilation and dependency resolution, as detailed in the BUILDING section, which can be a barrier for rapid deployment.
Lacks integrated dashboards or GUIs; users must export data to external tools for analysis, adding overhead for real-time insights.
Documentation is split across GitHub Wiki, CONFIG-KEYS, and other files, potentially making it harder to find cohesive guidance quickly.
Frequently Asked Questions
Related Projects
PCAPdroidNo-root network monitor, firewall and PCAP dumper for Android
Deepfence PacketStreamer:star: :star: Distributed tcpdump for cloud native environments :star: :star:
sharppcapOfficial repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
Netis Packet AgentA Software Probe for network packet capturing and forwarding in Cloud/Kubernetes and Virtualized environment.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.