nfdump
What it is
nfdump is a free, BSD-licensed suite for collecting, processing, and analyzing network flow data on Linux in self-hosted deployments. It collects NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow, and can convert live or PCAP-file traffic into flow data. Its analysis tools support tcpdump-like filters, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node information to flow records. Results can be exported as text, CSV, JSON, or user-defined formats. The suite includes collector and processing tools such as nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 require system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and the project is compatible with NfSen. nfcapd has no built-in access control, so host-level security should filter source IP addresses.
For and against
For
- Collects NetFlow, IPFIX, and sFlow data.
- Can convert live and PCAP traffic into flows.
- Supports text, CSV, JSON, and custom output.
- Root privileges are not required for most ports.
Against
- nfcapd has no built-in access control.
- ZSTD and bzip2 need system libraries.
- Legacy 1.6.x files may need conversion.
The verdict
nfdump provides a broad set of flow collection and analysis tools at no cost. Account for its access-control responsibility and file compatibility limits when planning deployment.
Who it suits
nfdump suits Linux administrators who need to collect and analyze network flow data in a self-hosted setup. It may also fit teams that want flow filtering, statistics, and export options without a paid plan.
Plans and prices
Free / BSD-licensed software
No paid plans or usage limits stated
Read 8 Oct 2026 · github.com
On the record
- Compatibility limit
- nfdump 1.7.x reads files created by nfdump 1.6.18 or newer, while legacy 1.6.x files may need conversion and only nfdump can read them directly.github.com · read 8 Oct 2026
- Compression
- Collected files can use LZO, LZ4, ZSTD, or bzip2 compression; ZSTD and bzip2 require system libraries.github.com · read 8 Oct 2026
- Enrichment
- Flow records can be enriched with geolocation, autonomous-system, and Tor exit-node information using optional databases.github.com · read 8 Oct 2026
- Filtering and aggregation
- It supports tcpdump-like flow filtering, user-defined aggregation, and flow statistics.github.com · read 8 Oct 2026
- Included tools
- The suite includes collector and processing tools such as nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay.github.com · read 8 Oct 2026
- Integrations
- The project documents metric export through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and says it is compatible with NfSen.github.com · read 8 Oct 2026
- License
- The project is distributed under a BSD license.github.com · read 8 Oct 2026
- Output
- Supported output formats include text, CSV, JSON, and user-defined formats.github.com · read 8 Oct 2026
- Privileges
- Root privileges are not required unless binding to ports below 1024.github.com · read 8 Oct 2026
- Protocol support
- It collects NetFlow versions 1, 5, 7, 9, IPFIX, and sFlow data.github.com · read 8 Oct 2026
- Purpose
- nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices.github.com · read 8 Oct 2026
- Security
- The documentation says nfcapd has no built-in access control, so host-level security should filter source IP addresses.github.com · read 8 Oct 2026
- Support
- The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions.github.com · read 8 Oct 2026
- Traffic conversion
- It can convert live or PCAP-file traffic into flow data.github.com · read 8 Oct 2026
