nfdump

Supports NetFlow v1, v5/v7, v9, IPFIX, and sFlow data, ensuring compatibility with diverse network devices as listed in the features.

Uses multi-threaded architecture for fast filtering and aggregation, enabling efficient handling of large flow datasets as emphasized in the README.

Filter syntax similar to tcpdump but optimized for flow data, allowing precise traffic selection for security and troubleshooting, with examples provided in basic usage.

Enriches flow records with geolocation, AS, and Tor exit node information using optional databases like GeoDB and TorDB, though setup is required.

Supports on-the-fly compression with LZO, LZ4, ZSTD, or bzip2, balancing performance and storage space, as detailed in the compression section.