pmacct Passive network monitoring tools to measure, account, aggregate, classify, and export IPv4 and IPv6 traffic
Download

pmacct Ranking & Summary

pmacct Tags

monitor network traffic network monitor traffic monitor traffic analysis

pmacct Description

Passive network monitoring tools to measure, account, aggregate, classify, and export IPv4 and IPv6 traffic IP accounting is key activity underlying popular ISP/IXP network operations like billing, graphing network resources usage, live or historical traffic trends analysis, management of network thresholds and SLA monitoring. Often SNMP counters do not help because of their coarse granularity; traffic mirroring, NetFlow and sFlow break this barrier by offering data at a finer granularity, ie. intercepting logical entities of greater interest such as Autonomous Systems, departmental or customer networks or just specific traffic flows. But actual high-speed large-scale networks are able to produce, in very short times, high amounts of data that become quickly difficult to be processed. In this context, traffic aggregation and advanced filtering and sampling capabilities become key requirements.pmacct is an open source and small set of passive network monitoring tools to measure, account, classify, export and aggregate IPv4 and IPv6 traffic.Either using memory or SQL tables as backend storage, pmacct can easily feed data into external tools including RRDtool, GNUPlot, Net-SNMP, MRTG and Cacti among the others. Little scripting abilities are required and a number of sample scripts, contributions, web frontends and some tutorials are already available. Here are some key features of "pmacct": · Runs on OS X, Linux, BSDs, Solaris and embedded systems · Support for both IPv4 and IPv6 · Collects data through libpcap, NetFlow v1/v5/v7/v8/v9 and sFlow v2/v4/v5 · Saves data to a number of backends including memory tables, MySQL, PostgreSQL and SQLite · Exports data to remote collectors through NetFlow v5/v9 and sFlow v5 (from 0.11.x) · Flexible architecture to tag, filter, redirect, aggregate and split captured data · Traffic streams classification. Read more here (from 0.10.x) · Support for packet and flow sampling and renormalization · Pluggable architecture for easy integration of new capturing environments and data backends · Careful SQL support: data pre-processing, triggers, recovery methods, dynamic table naming What's New in This Release: · Introduced support for tag ranges into the 'pre_tag_filter' configuration directive (ie. '10-20' matches traffic tagged in the range 10..20). This works both in addition to and in combination with negations. · Tcpdump-style filters, ie. 'aggregate_filter', now support indexing within a packet, ie. 'ether', to allow a more flexible separation of the traffic. · Introduced support for descriptions in networks definition files pointed by the 'networks_file' configuration directive. Thanks to Karl O. Pinc for contributing the patch. · fix, pmacctd: libpcap DLT_LINUX_SLL type is not defined in older versions of the library. It was preventing successful compilation of pmacct on OpenBSD. This has been fixed by defining internally to pmacct all DLT types in use. Thanks to Karl O. Pinc for his support. · fix, IPv6 networks_file, load_networks6(): wrong masks were applied to IPv6 networks due to dirty temporary buffers for storing IPv6 addresses and masks. Short '::' IPv6 format is currently not supported. Thanks to Robert Blechinger for flagging the issue. · fix, pretag.c: Pre-Tagging infrastructure was SEGV'ing after having been instructed to reload via a SIGHUP signal. Patch is courtesy of Denis Cavrois and the Acipia development team. · fix, sfacctd, nfacctd: Assign16() was not handling correctly 2-bytes EtherType values (ie. 0x86dd, 0x8847) in 802.1Q tags. As a result 'aggregate_filter' was not able to correctly match IPv6-related filters. Thanks to Axel Apitz for reporting the issue. · fix, xflow_status.c: a cosmetic bug was displaying sequence numbers without applying previous increment. This definitely will help troubleshooting and debugging. · fix, sfacctd, sfv245_check_status(): AF of the sFlow agent is now explicitely defined: when IPv6 is enabled the remote peer address can be reported as IPv4-mapped IPv6 address. This was causing warning messages to report the wrong sFlow agent IP address. Thanks to Axel Apitz for reporting the issue. · fix, IMT plugin was crashing upon receipt of a classification table request (WANT_CLASS_TABLE) when stream classification was actually disabled. · fix, pmacct.c: classifier index was not brought back to zero by the pmacct client. This was preventing the client to show correct stream classification when it was feeded with multiple queries. The fix is courtesy of Fabio Cairo. · fix, MySQL plugin: upon enabling of the 'nfacctd_sql_log' directive, 'stamp_updated' field was incorrectly reported as '0000-00-00 00:00:00' due to wrong field formatting. Thanks to Brett D'Arcy for reporting and patching the issue. · Initial effort to clean the code up by strcpy() calls. Thanks to Karl O. Pinc for taking such initiative.

pmacct Related Software