I think for IPFire ecosystem, pmacct is the best way to solve the problem you are addressing.
Here the official documentation:
This is one of the numerous discussions in the forum, you might find more searching the forum:
https://community.ipfire.org/t/pmacct-a-lightweight-passive-network-monitoring-tool