FREEDOM251

Freedom251 › Network Traffic Analysis Software

pmacct

Free plan LinuxSelf-hosted

Visit pmacct Alternatives

What pmacct is

pmacct is a free, self-hosted set of Linux tools for collecting and processing network traffic and routing information. Its collectors handle NetFlow, IPFIX and sFlow, while separate daemons collect BGP, BMP and Streaming Telemetry. Users can replicate and export network information, then filter, sample, tag, classify, renormalize and aggregate traffic, including at layer 7. Data can be kept in memory, relational or NoSQL databases, or flat files, and published to AMQP or Kafka brokers. Documented options include MySQL/MariaDB, PostgreSQL, SQLite, MongoDB, Elasticsearch, InfluxDB, Druid and ClickHouse. Output formats include tab-spaced text, CSV, JSON and Apache Avro; the command-line client can query memory-table data. Official Docker images cover seven daemons and target linux/amd64 and linux/arm64, with arm64 support marked experimental. SQL, AMQP and Kafka plugins are disabled by default and require compile-time support. The project advises planning for CPU, memory and disk use if retaining every flow; its memory plugin is intended for prototyping, labs without mass traffic generation, and smaller or home production environments.

Who it suits

It suits Linux administrators and network operators who need configurable collection, classification and export of traffic data. Docker and Kubernetes deployment guidance is available, while the memory plugin is aimed at prototyping, labs and smaller or home production environments.

What it does well

  • Collects NetFlow, IPFIX and sFlow traffic.
  • Supports BGP, BMP and Streaming Telemetry collection.
  • Offers filtering, sampling, tagging and aggregation.
  • Exports text, CSV, JSON and Apache Avro.
  • Provides official Docker images for seven daemons.

What to know first

  • SQL, AMQP and Kafka plugins are disabled by default.
  • Those plugins require compile-time support.
  • Docker arm64 support is marked experimental.
  • Storing every flow can increase CPU, memory and disk use.

Limits

SQL, AMQP, and Kafka plugins are disabled by default and require support enabled at compile time. The memory plugin is described for prototyping, lab use without mass traffic generation, and smaller or home production environments.

Getting started

  1. Visit the pmacct website and review the quickstart, FAQ, and configuration documentation.
  2. Use Linux or a documented self-hosted container setup.
  3. Install libpcap and its headers, the quickstart's stated package dependency.
  4. Enable SQL, AMQP, or Kafka support at compile time if you need those plugins.
  5. Choose a storage destination or broker and configure traffic collection and processing.

Verdict

pmacct combines collection, traffic processing and multiple storage or messaging outputs in a free, self-hosted Linux package. Plan for resource use when retaining every flow, and account for compile-time setup if you need SQL, AMQP or Kafka plugins.

Questions

Does pmacct have a free plan?

Yes. pmacct is listed as free, with a free plan; there is no free trial.

Which platforms does it support?

It is for Linux and self-hosted deployments. Official Docker images are built for linux/amd64 and linux/arm64, with arm64 marked experimental.

Which traffic protocols can it collect?

Its tools collect or export NetFlow v1, v5, and v9, IPFIX, and sFlow v2, v4, and v5. Separate daemons collect BGP, BMP, and Streaming Telemetry data.

Which databases and message brokers are supported?

Documented options include MySQL/MariaDB, PostgreSQL, SQLite, BerkeleyDB, MongoDB, RabbitMQ, and Kafka. Elasticsearch, InfluxDB, Druid, and ClickHouse are also named as consumer options through messaging brokers.

What are the main setup requirements?

The quickstart identifies libpcap and its headers as the package's only dependency. SQL, AMQP, and Kafka plugins are disabled by default and require their support to be enabled at compile time.

Facts from pmacct's own pages

Build requirements
The quickstart says libpcap and its headers are the package’s only dependency, while SQL, AMQP and Kafka plugins are disabled by default. · github.com, 3 Oct 2026
Collection and processing
It can collect, replicate and export network information, and aggregate, filter, sample, renormalize, tag and classify traffic at layer 7. · github.com, 3 Oct 2026
Command line client
The pmacct client can query memory-table data and format output as text, CSV, or JSON. · github.com, 4 Oct 2026
Configuration limit
SQL, AMQP, and Kafka plugins are disabled by default and require their support to be enabled at compile time. · github.com, 4 Oct 2026
Container platforms
Official Docker images are built for linux/amd64 and linux/arm64, with arm64 support marked experimental. · github.com, 3 Oct 2026
Data destinations
The project documents output to MySQL, PostgreSQL, SQLite, flat files, AMQP, and Kafka. · github.com, 4 Oct 2026
Deployment
The project provides official Docker images and build instructions for Debian or Ubuntu and CentOS or RHEL. · github.com, 4 Oct 2026
Documentation
The repository links to a wiki and includes a quickstart, FAQ, configuration key reference, examples and SQL documentation. · github.com, 3 Oct 2026
Integrations
The documentation names MySQL/MariaDB, PostgreSQL, SQLite, BerkeleyDB, MongoDB, RabbitMQ, Kafka, Elasticsearch, InfluxDB, Druid and ClickHouse among supported storage or consumer options. · github.com, 3 Oct 2026
Message consumers
The documentation names Elasticsearch, InfluxDB, Druid, and ClickHouse as examples of systems that can consume data through messaging brokers. · github.com, 4 Oct 2026
Output formats
The print plugin supports tab-spaced, CSV, and JSON output, and the documentation also describes Apache Avro output. · github.com, 4 Oct 2026
Product
pmacct is a set of passive network monitoring tools for NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP and Streaming Telemetry. · github.com, 3 Oct 2026
Protocols
Its tools cover NetFlow, IPFIX, sFlow, libpcap, BGP, BMP, RPKI, IGP, and Streaming Telemetry. · github.com, 4 Oct 2026
Purpose
pmacct is a set of passive network monitoring tools for accounting, classifying, aggregating, and exporting network traffic. · github.com, 4 Oct 2026
Resource considerations
The FAQ cautions that storing every flow can increase CPU, memory and disk use and recommends planning resources for that level of detail. · github.com, 3 Oct 2026
Scale guidance
The documentation says the memory plugin is intended for prototyping, lab use without mass traffic generation, and smaller or home production environments. · github.com, 4 Oct 2026
Scaling
The FAQ says deployments can scale through aggregation, filtering, sampling and tagging, or by distributing input across multiple pmacct instances. · github.com, 3 Oct 2026
Security information
The opened project pages describe collection and output capabilities but do not state security certifications or compliance attestations. · github.com, 4 Oct 2026
Storage and output
Traffic data can be stored in memory, relational or NoSQL databases, and flat files, or published to AMQP and Kafka brokers. · github.com, 3 Oct 2026
Support and documentation
The project points users to online GitHub wiki pages and documentation included in the distribution, including a quickstart and FAQ. · github.com, 4 Oct 2026
Support and troubleshooting
The Docker documentation provides troubleshooting guidance and says bug reporters may be asked to provide debugging information. · github.com, 3 Oct 2026
Traffic processing
Traffic data can be filtered, sampled, tagged, classified, and aggregated using configurable primitives. · github.com, 4 Oct 2026

Where pmacct stands on Freedom251

Look at these too