Skip to content


Folders and files

Last commit message
Last commit date

Latest commit



59 Commits

Repository files navigation

promacct: a pcap-based traffic accounting tool for Prometheus

The utility provided by this repository is similar to pmacct. It can use libpcap to inspect traffic on a network interface and store statistics regarding the number of packets and their size. In addition to storing the total amount of traffic, it also has support for aggregating by source/destination IPv4 address.

Where this utility differs from pmacct is that it doesn't store its results in a database. Instead, it binds a HTTP server that exports a metrics page that can be scraped by Prometheus. By default, this HTTP server listens on port 9112.

Building promacct

Right now promacct is still simple enough that it can easily be built by hand. Be sure to take a look at to see how. The script builds a statically linked executable for Linux-based systems.

Promacct has very few dependencies. It's written in C++, making use of certain C++17 features. It makes use of libpcap.

Using promacct

After building promacct, it can be started as follows:

promacct -i eth0 -i eth1 -r

This makes promacct sniff for traffic on eth0 and eth1, storing the total amount of traffic in separate histograms. It also creates histograms for the aggregated amount of network traffic for every individual IPv4 address between and To each of these entries, it also attaches the labels customer and environment, having the values acmecorp and production, respectively.

Useful Prometheus rules

The following rule can be used to compute a five-minute rate of all traffic per host and network interface:

instance_interface:promacct_packet_size_bytes_all:rate5m =
    by (instance, interface)

This metric can be used to compute a monthly 95th percentile as follows:

instance_interface:promacct_packet_size_bytes_all:quantile31d{quantile="0.95"} =
    quantile_over_time(0.95, instance_interface:promacct_packet_size_bytes_all:rate5m[31d])


Network accounting daemon for Prometheus



Code of conduct





No packages published