nfdump
A suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices.
What is nfdump?
nfdump is a suite of open-source tools for processing NetFlow, IPFIX, and sFlow data from network devices. It solves the problem of collecting and analyzing network traffic flow records for monitoring, security, and troubleshooting purposes by providing efficient collection, advanced filtering, and flexible data export capabilities.
Network administrators, security analysts, and DevOps engineers who need to monitor and analyze network traffic patterns, detect anomalies, and perform security investigations using flow data from routers and switches.
Developers choose nfdump for its high-performance processing, extensive filtering capabilities similar to tcpdump, and flexibility in output formats and data enrichment, making it a robust, extensible alternative to commercial flow analysis tools.
Overview
Netflow processing tools
Use Cases
Best For
- Collecting and storing NetFlow/IPFIX/sFlow data from multiple network devices
- Filtering and aggregating network traffic flows for security incident analysis
- Enriching flow records with geolocation and AS information for traffic profiling
- Converting live pcap traffic or interface captures to NetFlow format
- Exporting flow metrics to monitoring systems like InfluxDB or Prometheus
- Analyzing historical network traffic patterns for capacity planning
Not Ideal For
- Real-time packet-level inspection and deep packet analysis
- Teams needing integrated graphical dashboards without command-line work
- Environments with unsupported or proprietary flow formats beyond NetFlow/IPFIX/sFlow
- Small-scale setups where simpler, out-of-the-box monitoring tools suffice
Pros & Cons
Pros
Supports NetFlow v1, v5/v7, v9, IPFIX, and sFlow data, ensuring compatibility with diverse network devices as listed in the features.
Uses multi-threaded architecture for fast filtering and aggregation, enabling efficient handling of large flow datasets as emphasized in the README.
Filter syntax similar to tcpdump but optimized for flow data, allowing precise traffic selection for security and troubleshooting, with examples provided in basic usage.
Enriches flow records with geolocation, AS, and Tor exit node information using optional databases like GeoDB and TorDB, though setup is required.
Supports on-the-fly compression with LZO, LZ4, ZSTD, or bzip2, balancing performance and storage space, as detailed in the compression section.
Cons
Requires GNU autotools 2.71 and OS-specific steps, such as devtoolset on CentOS 7.x or clang-10 on Ubuntu 18.04, adding setup overhead and potential compatibility issues.
Only the nfdump tool can read files from nfdump-1.6.x; other programs require conversion, creating interoperability challenges and extra steps for older data.
nfcapd has no access control, relying on host-level security, which might be insufficient for deployments needing fine-grained authentication or encryption.
Enrichment features like geolocation and Tor lookup depend on separate database setups and maintenance, adding operational complexity and potential points of failure.
Frequently Asked Questions
Related Projects
BruteSharkNetwork Analysis Tool
PcapPlusPlusPcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP and PF_RING.
EttercapEttercap Project
tcpflowTCP/IP packet demultiplexer. Download from:
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.