pmacct NetFlow Accounting on Ubuntu 24.04

Turn a firehose of flow records into queryable accounting

pmacct is a mature, widely deployed suite of passive network monitoring tools. Its collector daemon nfacctd receives NetFlow v5 and v9 and IPFIX exports; sfacctd does the same for sFlow; and pmacctd can account traffic directly from a captured interface. Every flow is aggregated in memory by the primitives you choose, such as source and destination host, source and destination port, IP protocol and autonomous system, and the running totals of packets and bytes are written to a backend. That turns a firehose of raw flow records into compact, queryable accounting: who talked to whom, over which ports and protocols, and how much traffic each conversation carried. It is the engine many organisations use for capacity planning, traffic engineering, peering analysis, billing and security investigation, all without sending any data to a third party.

Self contained and provable the moment it boots

A collector with nothing exporting to it is idle, so this image is built to stand on its own. A local PostgreSQL is bundled on the same VM, bound to the loopback interface, as the accounting backend the collector writes into. A bundled softflowd reads this VM's own interface and exports NetFlow to the collector, so real traffic is accounted from the first boot. A second bundled tool injects a synthetic flow with a known signature, so you can prove the whole pipeline, receive, aggregate, store and query, on this one VM before you point a single router at it.

One public port, and it is the legitimate ingress

A flow collector with a database behind it is only as safe as its exposure, so this image is locked down by default. Exactly one port is open to the network: the collector port on which nfacctd receives NetFlow, sFlow and IPFIX. NetFlow has no application level authentication by protocol design, so you restrict access to it at the network layer by allowing only the subnet your routers export from. The PostgreSQL database is bound to the loopback interface and refuses connections on the VM's routable address, so the accounting data and the database credential are never reachable from the network.

Secure by default, no baked credential

Nothing is baked into the image. There is no database credential and no collector configuration in the captured image at all: the per VM database password is generated on first boot, and the collector is gated so that it physically cannot start until that has happened. There is no shared password between customers. A bundled self check re verifies the whole appliance on demand, injecting a known flow and confirming it is aggregated into the database, and confirming the database is loopback only.

What you get

• pmacct 1.7.9 from the official upstream release, verified against a pinned checksum, built with the PostgreSQL and JSON plugins, running under systemd
• PostgreSQL from Ubuntu, bound to the loopback interface, as the accounting backend
• softflowd 1.1.0, the bundled flow source that accounts this VM's own interface traffic from first boot
• A synthetic flow generator and a self check that prove real aggregated accounting end to end
• A per VM database credential generated on first boot, with no default login and nothing baked into the image
• Unattended security upgrades left enabled, and 24/7 cloudimg support

Licensing

pmacct is distributed under the GNU General Public License version 2, and the bundled softflowd under a BSD licence and PostgreSQL under the PostgreSQL licence, all free to redistribute. The cloudimg charge ($0.04 per vCPU/hour) covers packaging, security patching, image maintenance and 24/7 expert support. cloudimg is an independent image publisher and is not affiliated with or endorsed by the pmacct project.